PT-2024-10267 · Oracle · Jd Edwards Enterpriseone Tools

Published 2024-12-25 · Updated 2025-01-22 · CVE-2025-21517

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0

Description The issue is related to a vulnerability in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools, which can be exploited by a low-privileged attacker with network access via HTTP. This vulnerability allows unauthorized update, insert, or delete access to some of JD Edwards EnterpriseOne Tools' accessible data. The vulnerability is associated with weaknesses in the authorization mechanism, potentially enabling a remote attacker to read, modify, and delete files.

Recommendations For versions prior to 9.2.9.0, update to version 9.2.9.0 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BDU:2025-00669

CVE-2025-21517

Affected Products

Jd Edwards Enterpriseone Tools

References · 6

• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21517 · Security Note
• https://bdu.fstec.ru/vul/2025-00669 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21517 · Vendor Advisory
• https://twitter.com/CVEnew/status/1881821764071858444 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2025012219 · Note