Detections
Analytics

Oracle Identity Manager < 12.2.1.4.0 / < 14.1.2.1.0 Remote Code Execution

critical Web App Scanning Plugin ID 115045

Language:

Synopsis

Oracle Identity Manager < 12.2.1.4.0 / < 14.1.2.1.0 Remote Code Execution

Description

Oracle Identity Manager versions prior to 12.2.1.4.0 or prior to 14.1.2.1.0 are vulnerable to a Remote Code Execution through the REST WebServices component. An unauthenticated attacker can achieve remote code execution on the underlying server via a crafted REST request.

Solution

Upgrade to Oracle Identity Manager version 12.2.1.4.0 or 14.1.2.1.0 or later.

See Also

https://www.oracle.com/security-alerts/cpuoct2025.html

Plugin Details

Severity: Critical

ID: 115045

Type: remote

Published: 11/24/2025

Updated: 11/24/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-61757

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2025-61757

Vulnerability Information

CPE: cpe:2.3:a:oracle:identity_manager:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/20/2025

Vulnerability Publication Date: 10/20/2025

CISA Known Exploited Vulnerability Due Dates: 12/12/2025

Reference Information

CVE: CVE-2025-61757