Introduction: Real-World Impact and Significance
An attacker who exploits this vulnerability can read and modify business-critical data in Oracle Product Hub without authorization. That can directly disrupt supply chain, product management, and compliance operations. Organizations that run core business processes on Oracle E-Business Suite face significant risk if attackers use the flaw to alter or exfiltrate sensitive product information.
Oracle is one of the largest enterprise software vendors in the world, and thousands of organizations across industries deploy its E-Business Suite (EBS). The Product Hub module is central to managing product data, catalogs, and related business logic. That makes it a high-value target for attackers who want access to operational data.
Technical Information
CVE-2025-53043 is a vulnerability in the Item Catalog component of Oracle Product Hub within E-Business Suite. The supported versions 12.2.3 through 12.2.14 are affected. A low-privileged attacker with network access via HTTP can:
- Create, delete, or modify critical Product Hub data
- Access all data available through Product Hub endpoints without proper authorization
Technical Details:
- Attack vector: HTTP network access
- Privilege required: Low (does not require full admin rights)
- User interaction: None
- Scope: Unchanged
- Impact: High on confidentiality and integrity, none on availability
- CVSS 3.1 Base Score: 8.1
- CVSS Vector:
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
No public exploit code or vulnerable code snippets are available. Public sources do not detail the root cause. The vulnerability is classified as easily exploitable, which suggests insufficient authorization checks or improper access control in the Item Catalog component.
Affected Systems and Versions
- Product: Oracle Product Hub (E-Business Suite)
- Component: Item Catalog
- Affected versions: 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14
- Only supported versions in this range are affected
- All configurations that expose Product Hub endpoints to HTTP network access are at risk
Vendor Security History
Oracle E-Business Suite has a history of critical vulnerabilities, including issues in Product Hub and related modules. Oracle typically releases Critical Patch Updates every quarter and issues out-of-cycle advisories for high-impact vulnerabilities. Its response is generally prompt, but complex EBS environments can slow patch adoption in enterprise settings.
