Vulnerability in Java VM of Oracle Database Server
CVE-2025-21553

4.2MEDIUM

Key Information:

Vendor
Oracle
Status
Oracle Database Server
Vendor
CVE Published:
21 January 2025

Summary

A vulnerability exists in the Java VM component of Oracle Database Server allowing a low-privileged attacker with specific privileges to exploit it. This vulnerability can enable unauthorized updates, insertions, or deletions of Java VM accessible data, as well as unauthorized reading of certain data. Affected versions include Oracle Database Server 19.3 to 19.25, 21.3 to 21.16, and 23.4 to 23.6. The vulnerability can be exploited over the network via Oracle Net, highlighting the need for immediate attention from users of affected versions to safeguard their data.

Affected Version(s)

Oracle Database Server 19.3 <= 19.25

Oracle Database Server 21.3 <= 21.16

Oracle Database Server 23.4 <= 23.6

References

https://www.oracle.com/security-alerts/cpujan2025.html
vendor-advisory

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.