CVE-2025-21524

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujan2025.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*

History

17 Mar 2025, 19:49

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpujan2025.html -~~	() https://www.oracle.com/security-alerts/cpujan2025.html - Vendor Advisory
CPE		cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::
First Time		Oracle jd Edwards Enterpriseone Tools Oracle

31 Jan 2025, 21:15

Type	Values Removed	Values Added
CWE		CWE-306
Summary		(es) Vulnerabilidad en el producto JD Edwards EnterpriseOne Tools de Oracle JD Edwards (componente: Monitoring and Diagnostics SEC). Las versiones compatibles afectadas son anteriores a la 9.2.9.0. Esta vulnerabilidad, que se puede explotar fácilmente, permite que un atacante no autenticado con acceso a la red a través de HTTP ponga en peligro JD Edwards EnterpriseOne Tools. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la toma de control de JD Edwards EnterpriseOne Tools. Puntuación base de CVSS 3.1: 9,8 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

21 Jan 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-21 21:15

Updated : 2025-03-17 19:49

NVD link : CVE-2025-21524

Mitre link : CVE-2025-21524

CVE.ORG link : CVE-2025-21524

JSON object : View

Products Affected

oracle

jd_edwards_enterpriseone_tools

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-21524", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-01-21T21:15:18.070", "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2025.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto JD Edwards EnterpriseOne Tools de Oracle JD Edwards (componente: Monitoring and Diagnostics SEC). Las versiones compatibles afectadas son anteriores a la 9.2.9.0. Esta vulnerabilidad, que se puede explotar f\u00e1cilmente, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP ponga en peligro JD Edwards EnterpriseOne Tools. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la toma de control de JD Edwards EnterpriseOne Tools. Puntuaci\u00f3n base de CVSS 3.1: 9,8 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}], "lastModified": "2025-03-17T19:49:17.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F892AD9F-DBD0-4929-9E62-4DDD0339ACC4", "versionEndExcluding": "9.2.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}

9.8 /10