Oracle Scripting CVE-2025-61753

Exploitation requires the attacker to lure an authenticated-or-unauthenticated end user into clicking a crafted HTTP(S) link targeting the vulnerable Oracle Scripting open-redirect endpoint in Oracle E-Business Suite 12.2.3-12.2.14; the attacker needs no credentials (PR:N) but cannot succeed without victim interaction (UI:R), making this a phishing-dependent flaw rather than a server-side RCE. The principal limiting factor is the mandatory human click, meaning realistic risk is highest for internet-facing EBS instances whose Scripting URLs can be presented to users as trustworthy; purely internal or unexposed EBS deployments substantially reduce the practical attack surface.

This is a moderate-severity open redirect (CWE-601) in Oracle Scripting within Oracle E-Business Suite, with a well-aligned set of signals that point to real-but-not-urgent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) shows network-reachable, low-complexity, unauthenticated access but critically depends on user interaction (UI:R), which is consistent with an open-redirect/phishing primitive rather than direct server compromise. The scope change (S:C) and CWE-601 together indicate the impact lands partly outside the vulnerable component - the victim's browser is redirected to an attacker-controlled destination - which explains the low-but-nonzero confidentiality and integrity impacts (C:L/I:L) and absence of availability impact (A:N). The EPSS score of 0.23% (13th percentile) is low and agrees with the absence of KEV listing and the absence of any public PoC, so there is no evidence of active or imminent widespread exploitation. There are no conflicting signals here: a CVSS-network vector that genuinely requires human interaction, combined with low EPSS and no KEV, correctly reads as a lower-priority item than the 'network/unauthenticated' label alone might suggest. Prioritize patching as part of the normal Oracle October 2025 CPU cycle rather than as an emergency, with attention to internet-facing EBS deployments where the redirect could be weaponized for credential phishing.

An attacker crafts a malicious URL pointing at a legitimate internet-facing Oracle Scripting / E-Business Suite endpoint that includes an attacker-controlled redirect parameter, then delivers it via email or a web link. A victim who clicks the trusted-looking EBS link is transparently redirected to an attacker-controlled site (e.g., a credential-harvesting clone), leveraging the trust of the legitimate domain. No public exploit code has been identified at time of analysis, and success depends on the victim interacting with the link.