Oracle BI Publisher 7.6.0.0.0/12.2.1.4.0 XML Service denial of service

Summaryinfo

A vulnerability was found in Oracle BI Publisher 7.6.0.0.0/12.2.1.4.0. It has been classified as problematic. The impacted element is an unknown function of the component XML Service. The manipulation leads to denial of service. This vulnerability is listed as CVE-2025-30723. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Oracle BI Publisher 7.6.0.0.0/12.2.1.4.0. It has been rated as problematic. This issue affects an unknown code block of the component XML Service. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

It is possible to read the advisory at oracle.com. The identification of this vulnerability is CVE-2025-30723 since 03/25/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 234555 (Oracle Business Intelligence Publisher 7.6 (OAS) (April 2025 CPU)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234555). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Reporting Software

Vendor

• Oracle

Name

• BI Publisher

Version

• 7.6.0.0.0
• 12.2.1.4.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion