Listen to this Post
How the CVE Works:
CVE-2025-50060 is an access control vulnerability in Oracle BI Publisher (components: Web Server) affecting versions 7.6.0.0.0, 8.2.0.0.0, and 12.2.1.4.0. The flaw allows a low-privileged attacker with network access via HTTP to manipulate critical data or gain unauthorized access. The vulnerability arises due to improper validation of user permissions, enabling attackers to bypass restrictions and execute CRUD operations or exfiltrate sensitive data. The CVSS 3.1 score of 8.1 (High) reflects its high impact on confidentiality and integrity.
DailyCVE Form:
Platform: Oracle Analytics
Version: 7.6.0.0.0, 8.2.0.0.0, 12.2.1.4.0
Vulnerability: Access Control Bypass
Severity: Critical
Date: 07/15/2025
Prediction: Patch expected by 08/30/2025
What Undercode Say:
Analytics:
nmap -p 80 --script http-vuln-cve2025-50060 <target> curl -X POST -d "malicious_payload" http://<target>/bipublisher
How Exploit:
- Craft HTTP requests to bypass ACL checks.
- Abuse insufficient permission validation.
- Leverage POST/GET parameters for data manipulation.
Protection from this CVE:
- Apply Oracle’s upcoming patch.
- Restrict HTTP access to BI Publisher.
- Enforce role-based access controls.
Impact:
- Unauthorized data modification.
- Sensitive data exposure.
- Compliance violations.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
