PT-2025-16463 · Oracle · Oracle Communications Order/Service Management

Published 2025-04-15 · Updated 2025-04-29 · CVE-2025-30729

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0

Description The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. Additionally, successful attacks can cause a partial denial of service (partial DOS) of Oracle Communications Order and Service Management.

Recommendations For versions 7.4.0 through 7.5.0, update to a version that includes the fix for this issue to prevent unauthorized access and potential denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-30729

Affected Products

Oracle Communications Order/Service Management

References · 6

• https://osv.dev/vulnerability/CVE-2025-30729 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30729 · Security Note
• https://twitter.com/CVEnew/status/1912247278968184989 · Twitter Post
• https://twitter.com/dailycve/status/1917334537249435655 · Twitter Post
• https://t.me/cvetracker/21666 · Telegram Post