SB20250416144 - Multiple vulnerabilities in JD Edwards EnterpriseOne Tools

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2024-47554)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling untrusted input passed to the org.apache.commons.io.input.XmlStreamReader class. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Improper input validation (CVE-ID: CVE-2025-21586)

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

3) Infinite loop (CVE-ID: CVE-2024-25710)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing a corrupt DUMP file. A remote attacker can consume all available system resources and cause denial of service conditions.

4) Improper input validation (CVE-ID: CVE-2024-45613)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Platform (CKEditor) component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

5) Improper input validation (CVE-ID: CVE-2025-30709)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

6) Improper input validation (CVE-ID: CVE-2025-30740)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

7) Out-of-bounds read (CVE-ID: CVE-2024-5535)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the SSL_select_next_proto() function when using NPN. A remote attacker can send specially crafted data to the application, trigger an out-of-bounds read and perform a denial of service (DoS) attack.

8) Use-after-free (CVE-ID: CVE-2024-23807)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the XML parser when scanning of external DTDs. A remote attacker can pass specially crafted input to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability exists due to an incorrect fix for #VU24140 (CVE-2018-1311).

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuapr2025.html?3195