PT-2025-29596 · Oracle · Oracle Mobile Field Service+1

Published 2025-07-15 · Updated 2025-10-04 · CVE-2025-30744

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Mobile Field Service versions 12.2.3 through 12.2.13

Description An easily exploitable issue exists in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Multiplatform Sync Errors). A low-privileged attacker with network access via HTTP can compromise the application. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, or complete access to all Oracle Mobile Field Service accessible data.

Recommendations Versions prior to 12.2.3 are not affected. Versions 12.2.3 through 12.2.13 should be updated to a newer, fixed version when available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-08642

CVE-2025-30744

Affected Products

Oracle E-Business Suite

Oracle Mobile Field Service

References · 9

• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30744 · Security Note
• https://bdu.fstec.ru/vul/2025-08642 · Security Note
• https://twitter.com/dailycve/status/1948802718497226970 · Twitter Post
• https://secureblink.com/cyber-security-news/hackers-demand-50-million-in-mass-extortion-attack-targeting-unpatched-systems · Note
• https://t.me/aptreports/22532 · Telegram Post
• https://t.me/aptreports/22534 · Telegram Post
• https://twitter.com/CVEnew/status/1945207884716945767 · Twitter Post