CVE-2025-30724: Infoleak

Published Apr 15, 2025

Updated

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle BI Publisher

Oracle BI Publisher=7.6.0.0.0

Oracle BI Publisher=12.2.1.4.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2025.html

Event History

Apr 15, 2025

CVE Published

via MITRE·08:31 PM

Data Sourced

via MITRE·08:31 PM

DescriptionSeverity

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-30724?

CVE-2025-30724 is classified as an easily exploitable vulnerability that poses a serious risk to affected Oracle BI Publisher versions.

How do I fix CVE-2025-30724?

To fix CVE-2025-30724, apply the latest security patches provided by Oracle for the affected BI Publisher versions.

Which versions are affected by CVE-2025-30724?

CVE-2025-30724 affects Oracle BI Publisher versions 7.6.0.0.0 and 12.2.1.4.0.

What are the risks associated with CVE-2025-30724?

The risks associated with CVE-2025-30724 include unauthorized access and compromise of sensitive data in Oracle BI Publisher.

Is it possible for an attacker to exploit CVE-2025-30724 remotely?

Yes, CVE-2025-30724 can be exploited by an unauthenticated attacker with network access via HTTP.