CVE-2025-21547

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21547", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2024-12-24T23:18:54.774Z", "datePublished": "2025-01-21T20:53:15.077Z", "dateUpdated": "2025-03-18T19:02:25.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2025-01-21T20:53:15.077Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Hospitality OPERA 5", "cpes": ["cpe:2.3:a:oracle:hospitality_opera_5:5.6.19.20:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.25.8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.26.6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.27.1:*:*:*:*:*:*:*"], "versions": [{"version": "5.6.19.20", "status": "affected"}, {"version": "5.6.25.8", "status": "affected"}, {"version": "5.6.26.6", "status": "affected"}, {"version": "5.6.27.1", "status": "affected"}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2025.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-22T17:55:38.912423Z", "id": "CVE-2025-21547", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T19:02:25.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21547", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-22T17:55:38.912423Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-22T17:56:15.585Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:oracle:hospitality_opera_5:5.6.19.20:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.25.8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.26.6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.27.1:*:*:*:*:*:*:*"], "vendor": "Oracle Corporation", "product": "Oracle Hospitality OPERA 5", "versions": [{"status": "affected", "version": "5.6.19.20"}, {"status": "affected", "version": "5.6.25.8"}, {"status": "affected", "version": "5.6.26.6"}, {"status": "affected", "version": "5.6.27.1"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2025.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2025-01-21T20:53:15.077Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21547", "state": "PUBLISHED", "dateUpdated": "2025-03-18T19:02:25.974Z", "dateReserved": "2024-12-24T23:18:54.774Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2025-01-21T20:53:15.077Z", "assignerShortName": "oracle"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:oracle:hospitality_opera_5:5.6.19.20:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.25.8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.26.6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hospitality_opera_5:5.6.27.1:*:*:*:*:*:*:*"], "product": "Oracle Hospitality OPERA 5", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "5.6.19.20"}, {"status": "affected", "version": "5.6.25.8"}, {"status": "affected", "version": "5.6.26.6"}, {"status": "affected", "version": "5.6.27.1"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:hospitality_opera_5:5.6.19.20:*:*:*:*:*:*:*", "matchCriteriaId": "F1C43706-08BB-497C-BACD-29F02114C9A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:hospitality_opera_5:5.6.25.8:*:*:*:*:*:*:*", "matchCriteriaId": "462CD9C3-D903-4433-8537-E930BEAEE371", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:hospitality_opera_5:5.6.26.6:*:*:*:*:*:*:*", "matchCriteriaId": "7C5550B1-E8E4-4898-A629-FCAADC8865F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:hospitality_opera_5:5.6.27.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F9D7B16-41B5-46DF-B889-861EF34B4B37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Hospitality OPERA 5 de Oracle Hospitality Applications (componente: Opera Servlet). Las versiones compatibles afectadas son 5.6.19.20, 5.6.25.8, 5.6.26.6 y 5.6.27.1. Esta vulnerabilidad, que se puede explotar f\u00e1cilmente, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP ponga en peligro Oracle Hospitality OPERA 5. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado un acceso no autorizado a datos cr\u00edticos o un acceso completo a todos los datos accesibles de Oracle Hospitality OPERA 5 y la capacidad no autorizada de provocar un bloqueo o un bloqueo frecuente y repetible (DOS completo) de Oracle Hospitality OPERA 5. Puntuaci\u00f3n base CVSS 3.1 9.1 (impactos en la confidencialidad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)."}], "id": "CVE-2025-21547", "lastModified": "2026-06-17T08:43:42.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21547", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-22T17:55:38.912423Z", "version": "2.0.3"}}]}, "published": "2025-01-21T21:15:21.110", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2025.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}