{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-30733","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","state":"PUBLISHED","assignerShortName":"oracle","dateReserved":"2025-03-25T20:11:18.276Z","datePublished":"2025-04-15T20:31:19.398Z","dateUpdated":"2025-05-19T13:17:58.354Z"},"containers":{"cna":{"providerMetadata":{"orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle","dateUpdated":"2025-04-15T20:31:19.398Z"},"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS Listener.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS Listener accessible data."}]}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Database Server","versions":[{"version":"19.3","status":"affected","lessThanOrEqual":"19.26","versionType":"semver"},{"version":"21.3","status":"affected","lessThanOrEqual":"21.17","versionType":"semver"},{"version":"23.4","status":"affected","lessThanOrEqual":"23.7","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"19.3","versionEndIncluding":"19.26"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"21.3","versionEndIncluding":"21.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_-_rdbms_listener:*:*:*:*:*:*:*:*","versionStartIncluding":"23.4","versionEndIncluding":"23.7"}]}]}],"descriptions":[{"lang":"en-US","value":"Vulnerability in the RDBMS Listener component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS Listener.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS Listener accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)."}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2025.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}]},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-287","lang":"en","description":"CWE-287 Improper Authentication"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-16T14:56:24.603029Z","id":"CVE-2025-30733","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-04-16T14:56:59.370Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-05-19T13:17:58.354Z"},"references":[{"url":"https://driftnet.io/blog/oracle-tns-memory-leak"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}}]}}