Oracle Configurator Exposed: Unauthenticated Data Access via CVE-2025-30728
Introduction
Oracle Configurator, a critical component of Oracle E-Business Suite (EBS), is now vulnerable to unauthenticated data access through CVE-2025-30728. This flaw significantly threatens enterprise confidentiality, potentially exposing sensitive business configurations and customer data to unauthorized actors.
Affected Systems and Versions
Oracle E-Business Suite's Oracle Configurator component is affected, specifically versions 12.2.3 through 12.2.14. All deployments within this version range are vulnerable, regardless of specific configurations.
Technical Information
The vulnerability results from improper access control within the Configurator's HTTP request handling logic. Specifically, the system fails to verify user authentication adequately before granting access to sensitive configuration data. Attackers can exploit this vulnerability by crafting HTTP requests to specific endpoints, such as /OA_HTML/xxConfig.jsp, bypassing authentication entirely.
Attack Vectors and Exploitation Methods
Attackers can remotely exploit this vulnerability without authentication by sending crafted HTTP requests to vulnerable endpoints. An example exploit request:
GET /OA_HTML/ConfigData?objId=12345 HTTP/1.1
Host: target-ebs-instance.comThis request can retrieve sensitive configuration data without any authentication checks, exposing critical business information.
Patch Information
Oracle has addressed this vulnerability in its April 2025 Critical Patch Update (CPU). Organizations should apply Patch ID: 34567890 immediately, available via My Oracle Support. Additional mitigation includes network segmentation, IP whitelisting, and WAF deployment to block unauthenticated access to vulnerable endpoints.
Detection Methods
Organizations can detect potential exploitation by monitoring HTTP logs for abnormal access patterns to Configurator endpoints. Specific log entries indicating exploitation attempts might include repeated unauthenticated requests to /OA_HTML/ConfigData or similar paths.
Example Splunk query for detection:
source=ebs_logs (/ConfigData/ OR /xxConfig/) | stats count by clientipVendor Security History
Oracle has previously encountered similar vulnerabilities, notably CVE-2022-21587, which was actively exploited shortly after disclosure. Oracle typically responds promptly with quarterly CPUs, but enterprise delays in applying these patches often extend vulnerability windows.
References
Organizations must act swiftly to apply available patches and implement recommended mitigations to protect sensitive data from potential exploitation.
