VDB
BDU%3A2025-09247
BDU%3A2025-09247
PUBLISHED
CVSS 6.400000095367432 MEDIUM
Уязвимость компонентов EAI, UI (Oxygen XML WebHelp) системы управления взаимоотношениями с клиентами Oracle Siebel CRM, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании
Risk Scores
CVSS 2.0
6.400000095367432
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mitmproxy | pdoc | 0 |
| Oracle Corp. | Siebel CRM | |
| mitmproxy | pdoc | < 14.5.1 |
Timeline
- Jun 25, 2024 CVE Published
- Sep 5, 2024 PoC Published
- Feb 19, 2025 PoC Published
- Feb 19, 2025 PoC Published
- Feb 20, 2025 PoC Published
- Feb 20, 2025 PoC Published
- Feb 20, 2025 PoC Published
- Jun 22, 2025 PoC Published
- Jul 31, 2025 CVE Updated
- Aug 25, 2025 PoC Published
- Sep 15, 2025 PoC Published
References
- https://sansec.io/research/polyfill-supply-chain-attack url
- https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62 url
- https://github.com/mitmproxy/pdoc/pull/703 url
- https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526 url
- https://www.oracle.com/security-alerts/cpujan2025.html advisory
- https://www.oracle.com/security-alerts/cpujan2025verbose.html url