CVE-2025-21547
published 2025-01-21CVE-2025-21547: Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are…
PriorityP356critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.57%
43.3th percentile
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | hospitality_opera_5 | — | — |
| oracle | hospitality_opera_5 | — | — |
| oracle | hospitality_opera_5 | — | — |
| oracle | hospitality_opera_5 | — | — |
| oracle_corporation | oracle_hospitality_opera_5 | — | — |
| oracle_corporation | oracle_hospitality_opera_5 | — | — |
| oracle_corporation | oracle_hospitality_opera_5 | — | — |
| oracle_corporation | oracle_hospitality_opera_5 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_oracle9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Hospitality Applications Risk Matrix: Opera Servlet — CVE-2025-21547
vendor_oracle·2025-01-15·CVSS 9.1
CVE-2025-21547 [CRITICAL] Oracle Oracle Hospitality Applications Risk Matrix: Opera Servlet — CVE-2025-21547
Oracle Oracle Hospitality Applications Risk Matrix: Opera Servlet vulnerability
CVE: CVE-2025-21547
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
GHSA
GHSA-wcg3-v8j6-c8gg: Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet)
ghsa_unreviewed·2025-01-21
CVE-2025-21547 [CRITICAL] CWE-400 GHSA-wcg3-v8j6-c8gg: Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet)
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-21
Published