What is CVE-2025-30716?

CVE-2025-30716 is a high-severity vulnerability in Oracle Common Applications, classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-04-15.

How severe is CVE-2025-30716?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Oracle Common Applications

CVE-2025-30716

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vulnerability class: Broken Access Control

EPSS: 0.006 (47.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Oracle Common_applications
Oracle Corporation Common Applications — versions 12.2.3

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

secalert_us@oracle.com (vendor-advisory, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2025-30716?: CVE-2025-30716 is a high-severity vulnerability in Oracle Common Applications, classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-04-15.
How severe is CVE-2025-30716?: High severity. CVSS v3 base score is 7.5 out of 10.