CVE-2025-50067

Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2025.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:application_express:24.2.4:::::::*
	cpe:2.3:a:oracle:application_express:24.2.5:::::::*

History

24 Jul 2025, 21:27

Type	Values Removed	Values Added
CPE		cpe:2.3:a:oracle:application_express:24.2.4:::::::* cpe:2.3:a:oracle:application_express:24.2.5:::::::*
First Time		Oracle application Express Oracle
References	~~() https://www.oracle.com/security-alerts/cpujul2025.html -~~	() https://www.oracle.com/security-alerts/cpujul2025.html - Patch, Vendor Advisory

18 Jul 2025, 15:15

Type	Values Removed	Values Added
CWE		CWE-601

16 Jul 2025, 14:59

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-15 20:15

Updated : 2025-07-24 21:27

NVD link : CVE-2025-50067

Mitre link : CVE-2025-50067

CVE.ORG link : CVE-2025-50067

JSON object : View

Products Affected

oracle

application_express

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-50067", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2025-07-15T20:15:41.340", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2025.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en Oracle Application Express (componente: Strategic Planner Starter App). Las versiones compatibles afectadas son la 24.2.4 y la 24.2.5. Esta vulnerabilidad, f\u00e1cilmente explotable, permite a un atacante con privilegios reducidos y acceso a la red a trav\u00e9s de HTTP comprometer Oracle Application Express. Los ataques exitosos requieren la interacci\u00f3n humana de una persona distinta al atacante y, si bien la vulnerabilidad afecta a Oracle Application Express, pueden afectar significativamente a otros productos (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Application Express. Puntuaci\u00f3n base de CVSS 3.1: 9.0 (impactos en confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)."}], "lastModified": "2025-07-24T21:27:21.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:application_express:24.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE631EFE-2EE9-4B29-A473-288CE12DEA06"}, {"criteria": "cpe:2.3:a:oracle:application_express:24.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF3E7834-15C8-4319-A4E9-1A4D59787639"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}