CVE-2025-21553: oracle corporation oracle database server Incorrect Authorization

Vulnerability summary

CVE-2025-21553 is a medium (CVSS 4.2) Incorrect Authorization vulnerability in oracle corporation oracle database server. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities.

Timeline

1. 21-01-2025
   PublishedVulnerability first disclosed.
2. 04-02-2025
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.25, 21.3-21.16 and 23.4-23.6. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data as well as unauthorized read access to a subset of Java VM accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.