JD Edwards EnterpriseOne CVE-2025-53056

Exploitation REQUIRES human interaction from a victim other than the attacker (CVSS UI:R) - a legitimate user must be induced to click a crafted link or load attacker-supplied content served through JD Edwards EnterpriseOne Tools (Object and Environment Tech component) over HTTP. The attacker themselves needs no credentials (PR:N), but the dependence on a tricked user is the primary limiting factor and means this is not a hands-off, fully automatable network attack. Further limits: only EnterpriseOne Tools versions 9.2.0.0 through 9.2.9.4 are affected, impact is confined to a subset of accessible data (low confidentiality and low integrity, no availability impact), and the scope change (S:C) means the realistic blast radius depends on how the Tools component is integrated with adjacent products in the deployment.

This is a moderate-severity (CVSS 3.1 6.1) issue in Oracle JD Edwards EnterpriseOne Tools that does NOT warrant emergency prioritization. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reachability over HTTP with low complexity and no privileges, but exploitation is gated by UI:R - a human other than the attacker must be induced to act - and impact is limited (low confidentiality, low integrity, no availability). All corroborating exploitation signals point to low real-world urgency: EPSS is 0.23% (13th percentile), there is NO CISA KEV listing, and no public POC is present in the provided data, yielding the precise status 'no public exploit identified at time of analysis.' These signals are consistent with each other (low EPSS + no KEV + no POC = low near-term threat). One conflict to verify: the input Tag 'Authentication Bypass' does not match the assigned weakness CWE-285 (Improper Authorization), and the description describes authorization/scope-change data access with required user interaction (a pattern typical of XSS/CSRF-style flaws), not an authentication bypass - treat the 'Authentication Bypass' label as unreliable. Net: a legitimate patch-in-normal-cycle item, not a drop-everything priority.

An unauthenticated attacker crafts a malicious HTTP request, link, or page targeting the JD Edwards EnterpriseOne Tools Object and Environment Tech component and lures a legitimate logged-in user into interacting with it. Because of the scope change (S:C), the triggered action executes in a context that can reach additional products, granting the attacker limited unauthorized read plus insert/update/delete access to a subset of accessible data. No public exploit code is identified at the time of analysis, so this remains a plausible-but-unproven scenario.