CVE-2025-21532
Takeover of Oracle Analytics Desktop through its Install component
An easily exploitable flaw in the Install component lets a low privileged attacker with logon access to the host take over Oracle Analytics Desktop.
- CVE:
- CVE-2025-21532
- Severity:
- high
- CVSS:
- 7.8
- Product:
- Oracle Analytics Desktop (prior to 8.1.0)
- Status:
- public
- Class:
- CWE-276: Incorrect Default Permissions
- Published:
- 1/21/2025
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Oracle fixed this vulnerability in its January 2025 Critical Patch Update.
Impact
An attacker needs only low privileges and logon access to the infrastructure where Oracle Analytics Desktop runs. No user interaction is required. A successful attack results in takeover of the product, with high impact on confidentiality, integrity, and availability.
Affected versions
Oracle Analytics Desktop versions prior to 8.1.0.
Remediation
Upgrade to version 8.1.0 or later.