SB20251022146 - Multiple vulnerabilities in Oracle Utilities Application Framework

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2025-53864)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack via a deeply nested JSON object supplied in a JWT claim set.

2) Resource exhaustion (CVE-ID: CVE-2025-48976)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

3) Improper access control (CVE-ID: CVE-2025-48734)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to enum properties. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuoct2025.html?983871