CVE-2025-21532

HIGH

Oracle Analytics Desktop < 8.1.0 - Incorrect Default Permissions in Install Component

Title source: llm

Description

Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). Supported versions that are affected are Prior to 8.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Analytics Desktop executes to compromise Oracle Analytics Desktop. Successful attacks of this vulnerability can result in takeover of Oracle Analytics Desktop. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.oracle.com/security-alerts/cpujan2025.html

Scores

CVSS v3 7.8

EPSS 0.0025

EPSS Percentile 15.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-276

Status published

Products (1)

oracle/analytics_desktop < 8.1.0

Published Jan 21, 2025

Tracked Since Feb 18, 2026