PT-2025-29625 · Oracle · Oracle Database Server

Alexander Kornbrust · Published 2025-07-15 · Updated 2025-08-04 · CVE-2025-50070

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 23.4 through 23.8

Description A vulnerability exists within the JDBC component of Oracle Database Server. This difficult-to-exploit issue allows a low-privileged attacker with authenticated OS user privileges to compromise JDBC. Successful exploitation requires human interaction from a person other than the attacker. While the vulnerability resides in JDBC, attacks may impact additional products. Successful attacks can lead to unauthorized access to critical data or complete access to all JDBC accessible data.

Recommendations Versions prior to 23.4 and after 23.8 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-08661

CVE-2025-50070

Affected Products

Oracle Database Server

References · 8

• https://bdu.fstec.ru/vul/2025-08661 · Security Note
• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50070 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50070 · Vendor Advisory
• https://twitter.com/CVEnew/status/1945207859483959599 · Twitter Post
• https://twitter.com/dailycve/status/1948857826648162441 · Twitter Post
• https://twitter.com/kornbrust/status/1945555966818202071 · Twitter Post
• https://twitter.com/grok/status/1952386702871548222 · Twitter Post