Oracle E-Business Suite Information (CVE-2025-61884)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(270137);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/20");

  script_cve_id("CVE-2025-61884");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/10");

  script_name(english:"Oracle E-Business Suite Information (CVE-2025-61884)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an information disclosure vulnerability");
  script_set_attribute(attribute:"description", value:
"The version of Oracle E-Business Suite installed on the remote host is affected by an information disclosure
vulnerability as referenced in the CVE-2025-61884 Security Alert Advisory.

  - Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).
  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows
  unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks
  of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle
  Configurator accessible data. (CVE-2025-61884)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7ea1448a");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the CVE-2025-61884 Oracle Security Alert Advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-61884");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:e-business_suite");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_e-business_query_patch_info.nbin");
  script_require_keys("Oracle/E-Business/Version", "Oracle/E-Business/patches/installed");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_ebusiness::get_app_info();

var constraints = [  
  # At the time of writing Oracle has not confirmed which versions of Release 12.1.x are vulnerable
  # Doc ID 3107176.1 indicates "For Release 12.1, patches are pending."
  {'min_version': '12.2.3', 'max_version': '12.2.14.99999999', 'fix_patches': '38512809, 37614922'}
];

vcf::oracle_ebusiness::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  fix_date:'20251013'
);