PT-2025-16403 · Oracle · Oracle Secure Backup

Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-21578

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Secure Backup versions 12.1.0.1 through 12.1.0.3 Oracle Secure Backup versions 18.1.0.0 through 18.1.0.2

Description The issue allows a high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks can result in takeover of Oracle Secure Backup.

Recommendations For versions 12.1.0.1 through 12.1.0.3, update to a version that fixes this issue. For versions 18.1.0.0 through 18.1.0.2, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the Oracle Secure Backup infrastructure to minimize the risk of exploitation.

Fix

Incorrect Permission

RCE

Weakness Enumeration

CWE-732

CWE-20

Related Identifiers

BDU:2025-06666

CVE-2025-21578

Affected Products

Oracle Secure Backup

References · 5

• https://oracle.com/security-alerts/cpuapr2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21578 · Security Note
• https://bdu.fstec.ru/vul/2025-06666 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21578 · Vendor Advisory
• https://twitter.com/CVEnew/status/1912247334479753349 · Twitter Post