Oracle patches EBusiness Suite flaw enabling unauthenticated access

Oracle on Saturday released a patch and security advisory for a high severity vulnerability in its EBusiness Suite that could allow unauthenticated remote access to sensitive configuration data, the company said. Tracked as CVE202561884, the flaw affects the Runtime UI component of Oracle Configurator in EBusiness Suite versions 12.2.3 through 12.2.14 and carries a CVSS score of 7.5.

According to the U.S. National Vulnerability Database, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Oracle said the vulnerability can be exploited remotely without authentication or user interaction and recommended that customers apply available updates or mitigations promptly. Oracle Chief Security Officer Rob Duhart said the issue affects "some deployments" of EBusiness Suite and, if successfully exploited, "may allow access to sensitive resources."

The disclosure and patch come amid an ongoing security episode involving Oracle EBusiness Suite. Two weeks ago, dozens of organizations received extortion emails claiming that attackers had stolen data from their EBS instances. Investigations by security teams...