Oracle Health Sciences Data Management Workbench 3.4.0.1.3/3.4.1.0.10 Logger information disclosure

Summaryinfo

A vulnerability has been found in Oracle Health Sciences Data Management Workbench 3.4.0.1.3/3.4.1.0.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Logger. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2025-62288. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Oracle Health Sciences Data Management Workbench 3.4.0.1.3/3.4.1.0.10. This affects an unknown part of the component Logger. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). Supported versions that are affected are 3.4.0.1.3 and 3.4.1.0.10. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

The advisory is shared at oracle.com. This vulnerability is uniquely identified as CVE-2025-62288 since 10/10/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• Oracle

Name

• Health Sciences Data Management Workbench

Version

• 3.4.0.1.3
• 3.4.1.0.10

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion