JD Edwards EnterpriseOne CVE-2025-53060

Exploitation requires an attacker to induce human interaction from a legitimate user other than the attacker (UI:R) - i.e., the victim must click a crafted link or interact with malicious content served through the JD Edwards EnterpriseOne Tools Web Runtime SEC component over HTTP. No attacker authentication is required (PR:N). The primary LIMITING factor is this mandatory victim interaction: the attack cannot succeed autonomously and depends on successfully luring a user, which also means a reachable/exposed EnterpriseOne web interface and an active user session are needed. Affected deployments are EnterpriseOne Tools versions 9.2.0.0 through 9.2.9.4; environments on fixed Oracle CPU builds are not exposed. Impact is bounded to limited data read and limited data modification with no availability impact.

This is a moderate-risk issue that should not be prioritized as an emergency. The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N) but is tempered by a hard dependency on victim interaction (UI:R) and only partial confidentiality/integrity impact with no availability impact (C:L/I:L/A:N). The scope change (S:C) - Oracle's note that attacks 'may significantly impact additional products' - combined with UI:R and the C:L/I:L/A:N profile is the classic signature of a client-side injection flaw (e.g., stored/reflected XSS or CSRF) in the Web Runtime SEC component rather than direct server compromise. Corroborating signals point to low real-world urgency: EPSS is 0.23% (13th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code was identified. These exploitation-likelihood signals are mutually consistent (low EPSS, no KEV, no POC), so there is no conflict to reconcile here - the picture is coherently low-urgency. The notable data caveat is the input tag 'Authentication Bypass,' which conflicts with the actual profile: the vector already specifies PR:N (unauthenticated) and the CWE is CWE-284 (Improper Access Control) with a UI:R scope-change impact pattern typical of client-side injection - so 'authentication bypass' appears to be a mislabel and should be verified against the Oracle advisory, not treated as confirmed. Net: patch on a normal Oracle Critical Patch Update cadence, not as a drop-everything item.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the JD Edwards EnterpriseOne Tools Web Runtime and lures an authenticated user (someone other than the attacker) into triggering it. When the victim interacts with the crafted content, the flaw allows limited unauthorized read and unauthorized update/insert/delete of data, and because the scope changes it can spill into additional connected products. No public exploit code was identified at time of analysis.