PT-2025-16428 · Oracle · Oracle Database Server

Alberto Arganese + 3 · Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-30694

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.26 Oracle Database Server versions 21.3 through 21.17 Oracle Database Server versions 23.4 through 23.7

Description The issue is related to the XML Database component, allowing a low-privileged attacker with network access via HTTP to compromise the XML Database. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some XML Database accessible data, as well as unauthorized read access to a subset of XML Database accessible data.

Recommendations For versions 19.3 through 19.26, update to a version outside of this range to resolve the issue. For versions 21.3 through 21.17, update to a version outside of this range to resolve the issue. For versions 23.4 through 23.7, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the XML Database component to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2026-02535

CVE-2025-30694

Affected Products

Oracle Database Server

References · 6

• https://oracle.com/security-alerts/cpuapr2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30694 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30694 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02535 · Security Note
• https://support.oracle.com/signin/?kmContentId=2927522 · Note
• https://twitter.com/CVEnew/status/1912247311310442623 · Twitter Post