Oracle Secure Backup 12.x & 18.x General Privileged Exploit (CVE-2025-21578)
CVE-2025-21578 Published on April 15, 2025
Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Vulnerability Analysis
CVE-2025-21578 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. When a resource is given a permissions setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.
Products Associated with CVE-2025-21578
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-21578 are published in these products:
Affected Versions
Oracle Corporation Oracle Secure Backup:- Version 12.1.0.1 is affected.
- Version 12.1.0.2 is affected.
- Version 12.1.0.3 is affected.
- Version 18.1.0.0 is affected.
- Version 18.1.0.1 is affected.
- Version 18.1.0.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.