CVE-2025-30759: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2025-30759 is an improper access control vulnerability (CWE-284) in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. Affected versions are 7.6.0.0.0, 8.2.0.0.0, and 12.2.1.4.0. The vulnerability was disclosed on July 15, 2025, as part of Oracle's July 2025 Critical Patch Update. It carries a CVSS v3.1 base score of 6.1 (Medium), requiring no authentication but requiring user interaction, with a changed scope (Oracle CPU Jul 2025).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the Platform Security component of Oracle Business Intelligence Enterprise Edition. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires human interaction from a person other than the attacker (e.g., a victim clicking a malicious link). The changed scope indicates that a successful attack can impact resources beyond the vulnerable component itself, consistent with cross-site scripting or similar client-side injection attack patterns. The vulnerability was reported to Oracle by Jean-Michel Huguet of NATO Cyber Security Centre (NCSC) (Oracle CPU Jul 2025).

Successful exploitation can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data, as well as unauthorized update, insert, or delete access to some accessible data. The changed scope means attacks may significantly impact additional products beyond OBIEE itself. Availability is not impacted, but the combination of confidentiality and integrity impacts — particularly with scope change — could enable session hijacking, data theft, or manipulation of BI reports and dashboards visible to other users (Oracle CPU Jul 2025).

Oracle has released patches for all affected versions (7.6.0.0.0, 8.2.0.0.0, and 12.2.1.4.0) as part of the July 2025 Critical Patch Update. Oracle strongly recommends applying the CPU patches immediately. As a temporary measure, network access to Oracle OBIEE via HTTP can be restricted to trusted IP ranges to reduce exposure. Organizations should also implement user awareness measures given the user-interaction requirement of this vulnerability (Oracle CPU Jul 2025).