CVE-2025-21508: Medium severity oracle jd edwards enterpriseone tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21508?
CVE-2025-21508 is an easily exploitable vulnerability allowing low privileged attackers to compromise JD Edwards EnterpriseOne.
How do I fix CVE-2025-21508?
To fix CVE-2025-21508, upgrade to JD Edwards EnterpriseOne Tools version 9.2.9.0 or later.
Who is affected by CVE-2025-21508?
CVE-2025-21508 affects all supported versions of Oracle JD Edwards EnterpriseOne Tools prior to 9.2.9.0.
What type of vulnerability is CVE-2025-21508?
CVE-2025-21508 is classified as a web runtime security vulnerability.
Can CVE-2025-21508 be exploited remotely?
Yes, CVE-2025-21508 can be exploited by low privileged attackers with network access via HTTP.