CVE-2025-50070: Medium severity Oracle Database Server vulnerability
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 23.4-23.8. Difficult to exploit vulnerability allows low privileged attacker having Authenticated OS User privilege with logon to the infrastructure where JDBC executes to compromise JDBC. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JDBC, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JDBC accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50070?
CVE-2025-50070 is classified as a difficult to exploit vulnerability allowing low privileged authenticated OS users to compromise the JDBC component.
How do I fix CVE-2025-50070?
To mitigate the effects of CVE-2025-50070, update your Oracle Database Server to a version beyond 23.8.
Who is affected by CVE-2025-50070?
Organizations using Oracle Database Server versions 23.4 through 23.8 are affected by CVE-2025-50070.
What component is impacted by CVE-2025-50070?
CVE-2025-50070 impacts the JDBC component of the Oracle Database Server.
What are the privileges needed to exploit CVE-2025-50070?
A low privileged attacker must have Authenticated OS User privileges and be logged into the environment where JDBC executes to exploit CVE-2025-50070.