{"id":"CVE-2025-30733","state":"PUBLISHED","title":"Vulnerability in the RDBMS Listener component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnera","description":"Vulnerability in the RDBMS Listener component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS Listener.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS Listener accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","publishedAt":"2025-04-15T20:31:19.398Z","updatedAt":"2025-05-19T13:17:58.354Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"oracle"},"assigner":"oracle","products":["Oracle Corporation Oracle Database Server"],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Database Server","versions":[{"version":"19.3","status":"affected","lessThanOrEqual":"19.26","versionType":"semver"},{"version":"21.3","status":"affected","lessThanOrEqual":"21.17","versionType":"semver"},{"version":"23.4","status":"affected","lessThanOrEqual":"23.7","versionType":"semver"}]}],"references":["https://www.oracle.com/security-alerts/cpuapr2025.html","https://driftnet.io/blog/oracle-tns-memory-leak"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/30xxx/CVE-2025-30733.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-30733","state":"PUBLISHED","datePublished":"2025-04-15T20:31:19.398Z","dateUpdated":"2025-05-19T13:17:58.354Z","assignerShortName":"oracle","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateReserved":"2025-03-25T20:11:18.276Z"},"containers":{"cna":{"descriptions":[{"lang":"en-US","value":"Vulnerability in the RDBMS Listener component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS Listener.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS Listener accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)."}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Database Server","versions":[{"version":"19.3","status":"affected","lessThanOrEqual":"19.26","versionType":"semver"},{"version":"21.3","status":"affected","lessThanOrEqual":"21.17","versionType":"semver"},{"version":"23.4","status":"affected","lessThanOrEqual":"23.7","versionType":"semver"}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2025.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS Listener.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS Listener accessible data."}]}],"providerMetadata":{"shortName":"oracle","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateUpdated":"2025-04-15T20:31:19.398Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"19.3","versionEndIncluding":"19.26"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"21.3","versionEndIncluding":"21.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"23.4","versionEndIncluding":"23.7"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-16T14:56:24.603029Z","id":"CVE-2025-30733","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-16T14:56:59.370Z"}},{"title":"CVE Program Container","references":[{"url":"https://driftnet.io/blog/oracle-tns-memory-leak"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-05-19T13:17:58.354Z"},"x_generator":{"engine":"ADPogram 0.0.1"}}]}}}