PT-2025-29622 · Oracle · Oracle Application Express

Kanika Jalal · Published 2025-07-15 · Updated 2025-07-24 · CVE-2025-50067

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Application Express versions 24.2.4 through 24.2.5

Description An easily exploitable issue exists in the Strategic Planner Starter App component of Oracle Application Express. A low-privileged attacker with network access via HTTP can compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker. Exploitation may significantly impact additional products. Successful attacks can result in a takeover of Oracle Application Express.

Recommendations Update to a version beyond 24.2.5.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-08981

CVE-2025-50067

Affected Products

Oracle Application Express

References · 8

• https://bdu.fstec.ru/vul/2025-08981 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50067 · Security Note
• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50067 · Vendor Advisory
• https://t.me/cvenotify/129455 · Telegram Post
• https://twitter.com/dailycve/status/1948518300138291632 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1m1kd8a/oracles_critical_patch_update_hits_309 · Reddit Post
• https://twitter.com/CVEnew/status/1945207862172475766 · Twitter Post