CVE-2025-30716 — Missing Authorization in Corporation Oracle Common Applications

CWE-862 — Missing Authorization4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 37.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Oracle Common ApplicationsOracle Common Applications
Timeline
PublishedApr 15

Description

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Scor…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDoracle/common_applications12.2.3 — 12.2.14
▶CVEListV5oracle_corporation/oracle_common_applications12.2.3 — 12.2.14

Patches

Patch: www.oracle.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2025-30716: Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework)↗2025-04-15
▶
GHSA
GHSA-7jvh-56fg-c3rv: Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework)↗2025-04-15
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle E-Business Suite Risk Matrix: CRM User Management Framework — CVE-2025-30716↗2025-04-15
▶
CVE-2025-30716 — Missing Authorization | cvebase