CVE-2025-21498 Overview
CVE-2025-21498 is an information disclosure vulnerability in Oracle HTTP Server, a component of Oracle Fusion Middleware. The flaw resides in the Core component of version 12.2.1.4.0 and stems from missing authorization controls [CWE-862]. An unauthenticated attacker with network access via HTTP can exploit the issue to gain unauthorized read access to a subset of Oracle HTTP Server accessible data. Oracle addressed the issue in the January 2025 Critical Patch Update. The vulnerability does not impact integrity or availability, and no public exploit code has been observed.
Critical Impact
Unauthenticated remote attackers can retrieve a subset of Oracle HTTP Server data over HTTP without user interaction.
Affected Products
- Oracle HTTP Server 12.2.1.4.0 (Oracle Fusion Middleware, Core component)
- Deployments exposing Oracle HTTP Server directly to untrusted networks
- Fusion Middleware stacks bundling the affected HTTP Server release
Discovery Timeline
- 2025-01-21 - CVE-2025-21498 published to the National Vulnerability Database
- January 2025 - Oracle releases fix in the Critical Patch Update (CPU) advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21498
Vulnerability Analysis
The vulnerability lives in the Core component of Oracle HTTP Server 12.2.1.4.0. It allows an unauthenticated remote client to read data that should be restricted. The exploit path requires only network access over HTTP, no privileges, and no user interaction. Because the impact is confined to confidentiality of a subset of accessible data, the flaw is classified as information disclosure rather than full compromise.
Oracle's advisory identifies the weakness as an authorization gap. The server processes certain requests without applying the access controls expected for the requested resource. This behavior aligns with [CWE-862] Missing Authorization, where a code path fails to verify the requester's rights before returning data.
Root Cause
The root cause is a missing authorization check in a Core request-handling path of Oracle HTTP Server. Requests that should be gated by an access control decision are served without validation. As a result, protected content or metadata becomes reachable to any client that can reach the HTTP listener.
Attack Vector
Exploitation occurs over the network via HTTP. An attacker sends crafted HTTP requests to an exposed Oracle HTTP Server instance running the affected version. Since no authentication or user interaction is required, the vulnerability is reachable from any client with routing to the listener, including internet-facing deployments and lateral positions inside enterprise networks. The attacker receives partial data belonging to the HTTP Server context in the response.
No verified public proof-of-concept is available. Refer to the Oracle Security Alert January 2025 for authoritative technical details.
Detection Methods for CVE-2025-21498
Indicators of Compromise
- Unusual volumes of HTTP requests to Oracle HTTP Server endpoints from unauthenticated sources
- Successful HTTP 200 responses to requests that historically returned 401 or 403
- Requests targeting administrative or diagnostic URIs from external IP ranges
- Access log entries showing anonymous clients retrieving non-public resources
Detection Strategies
- Inventory all Oracle Fusion Middleware hosts and identify instances running Oracle HTTP Server 12.2.1.4.0
- Compare current server banners and patch levels against the January 2025 CPU baseline
- Review web access logs for anomalous request patterns aimed at Core component paths
- Correlate WAF or reverse proxy telemetry with Oracle HTTP Server access logs to surface bypass attempts
Monitoring Recommendations
- Forward Oracle HTTP Server access and error logs to a centralized SIEM for retention and analytics
- Alert on spikes of unauthenticated requests reaching sensitive URI patterns
- Baseline normal request rates per source IP and flag statistical outliers
- Monitor egress from the HTTP Server host for unexpected data transfer volumes
How to Mitigate CVE-2025-21498
Immediate Actions Required
- Apply the Oracle January 2025 Critical Patch Update to all affected Oracle HTTP Server 12.2.1.4.0 instances
- Restrict inbound HTTP access to the server using network ACLs, firewalls, or reverse proxies until patched
- Audit access logs for prior exploitation attempts against Core component endpoints
- Rotate any credentials, tokens, or keys that may have been exposed through the affected server
Patch Information
Oracle released the fix as part of the Oracle Critical Patch Update Advisory - January 2025. Administrators should apply the CPU bundle that corresponds to Oracle Fusion Middleware 12.2.1.4.0 and validate the patch level after deployment. Oracle recommends staying on supported CPU releases to maintain protection against known issues.
Workarounds
- Place Oracle HTTP Server behind a hardened reverse proxy or WAF that enforces authentication and URI allow-listing
- Disable or block access to non-essential Core component endpoints exposed to untrusted networks
- Limit HTTP Server exposure to trusted management VLANs where operationally feasible until the CPU is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
