Vulnerability in Oracle Secure Backup
CVE-2025-21578
Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
EPSS: 0.002 (10.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Oracle Secure_backup — versions 12.1.0.1, 12.1.0.2, 12.1.0.3
- Oracle Corporation Secure Backup — versions 12.1.0.1, 12.1.0.2, 12.1.0.3
Weakness classification (CWE)
References
- secalert_us@oracle.com (vendor-advisory, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-21578?
- CVE-2025-21578 is a medium-severity vulnerability in Oracle Secure Backup, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.7/10. Published 2025-04-15.
- How severe is CVE-2025-21578?
- Medium severity. CVSS v3 base score is 6.7 out of 10.