CVE-2025-30711: Oracle Applications Framework Auth Bypass

CVE-2025-30711 Overview

CVE-2025-30711 affects the Oracle Applications Framework component of Oracle E-Business Suite. The vulnerability resides in the Attachments and File Upload functionality across supported versions 12.2.3 through 12.2.14. A low-privileged attacker with network access via HTTP can exploit this flaw, but successful attacks require interaction from a user other than the attacker. The scope is changed, meaning exploitation impacts components beyond the vulnerable one. Successful exploitation allows unauthorized update, insert, or delete access to some data, plus read access to a subset of accessible data. Oracle addressed this issue in the April 2025 Critical Patch Update.

Critical Impact
Authenticated attackers can leverage a victim's browser interaction to modify and read data within Oracle Applications Framework, with cross-scope impact on additional Oracle E-Business Suite products.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.14
Oracle Applications Framework (Attachments, File Upload component)
Downstream Oracle E-Business Suite modules impacted through scope change

Discovery Timeline

2025-04-15 - Oracle publishes advisory in April 2025 Critical Patch Update and CVE-2025-30711 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30711

Vulnerability Analysis

The vulnerability sits in the Attachments and File Upload feature of the Oracle Applications Framework (OAF). OAF is the presentation-tier framework that renders self-service pages across Oracle E-Business Suite. Because the flaw involves file upload handling with a scope change and requires user interaction, the exploitation pattern is consistent with improper access control ([CWE-284]) delivered through a victim-triggered request. An authenticated attacker with low privileges can craft a malicious link or file upload flow that a legitimate user must interact with. The interaction then triggers actions with the victim's authority, allowing modification of data and disclosure of a subset of records that are otherwise outside the attacker's direct reach.

Root Cause

Oracle classifies the weakness under [CWE-284] Improper Access Control. The Attachments and File Upload path in OAF does not sufficiently constrain how uploaded content or attachment references are handled across security boundaries. This gap enables an authenticated user to influence operations executed in another user's session context, producing the observed cross-scope impact.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle E-Business Suite web tier. The attacker must hold valid low-privileged credentials to reach the vulnerable endpoints. A second user must then interact with attacker-supplied content, typically by opening a link or viewing an attachment. Oracle has not published exploit details, no public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Oracle Security Alert April 2025 for vendor-supplied technical context.

Detection Methods for CVE-2025-30711

Indicators of Compromise

Unexpected file uploads or attachment records created in FND_LOBS or related Attachments tables by low-privileged accounts
HTTP requests to OAF Attachments and File Upload endpoints containing unusual MIME types, filenames, or oversized payloads
Session activity where an authenticated user's account performs data modifications shortly after clicking an attachment link from another user

Detection Strategies

Correlate web-tier access logs with Oracle E-Business Suite audit trails to identify attachment uploads followed by cross-user data changes
Baseline normal attachment upload patterns per role and alert on deviations, especially from low-privileged accounts touching sensitive modules
Monitor for referer or origin mismatches on Attachments and File Upload requests that suggest user-interaction-driven exploitation

Monitoring Recommendations

Ingest Oracle E-Business Suite application, database, and web server logs into a centralized analytics platform for correlation
Enable Oracle audit policies on Attachments tables and OAF file handlers to record insert, update, and delete events
Alert on privileged data changes that occur within seconds of an inbound HTTP request carrying an attachment reference

How to Mitigate CVE-2025-30711

Immediate Actions Required

Apply the Oracle April 2025 Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.14
Inventory internet-exposed Oracle E-Business Suite instances and prioritize patching for externally reachable systems
Review recent Attachments and File Upload activity for signs of misuse before and after patching

Patch Information

Oracle released the fix for CVE-2025-30711 as part of the Oracle Critical Patch Update Advisory - April 2025. Administrators should follow Oracle's documented E-Business Suite patching procedure and validate the patch level on the OAF component after installation.

Workarounds

Restrict access to Oracle E-Business Suite self-service pages using network segmentation, VPN, or reverse-proxy allow lists until patches are applied
Reduce the number of accounts with access to Attachments and File Upload functionality to the minimum required
Train users to avoid interacting with unsolicited attachment links inside Oracle E-Business Suite pending remediation

bash

# Verify installed Oracle E-Business Suite patch level
# Run from the applications tier as the applmgr user
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM ad_bugs
WHERE bug_number IN ('<APRIL_2025_CPU_PATCH_ID>')
ORDER BY last_update_date DESC;
EXIT;
EOF