PT-2025-42946 · Oracle · Oracle Business Intelligence Enterprise Edition

Published 2025-10-21 · Updated 2025-10-22 · CVE-2025-53049

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition versions 7.6.0.0.0 through 8.2.0.0.0

Description A readily exploitable issue exists in Oracle Business Intelligence Enterprise Edition, specifically within the Analytics Web Administration component. An attacker with high privileges and network access via HTTP can compromise the software. Exploitation requires interaction from a user other than the attacker, and successful attacks may impact other products. Successful exploitation can lead to a complete takeover of Oracle Business Intelligence Enterprise Edition.

Recommendations Update Oracle Business Intelligence Enterprise Edition version 7.6.0.0.0 to a later version. Update Oracle Business Intelligence Enterprise Edition version 8.2.0.0.0 to a later version.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-15851

CVE-2025-53049

Affected Products

Oracle Business Intelligence Enterprise Edition

References · 6

• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53049 · Security Note
• https://bdu.fstec.ru/vul/2025-15851 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53049 · Vendor Advisory
• https://t.me/cveNotify/139939 · Telegram Post
• https://twitter.com/CVEnew/status/1980736625824215432 · Twitter Post