What is the CVSS score of CVE-2025-30758?

CVE-2025-30758 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2025-30758?

Yes, a patch is available for CVE-2025-30758. Update the affected software to the latest version immediately.

Oracle Siebel CRM CVE-2025-30758

MEDIUM

Information Exposure (CWE-200)

2025-07-15 secalert_us@oracle.com

Information Disclosure Oracle Siebel Crm

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Oracle-provided vector is consistent with description: unauthenticated HTTP access, low complexity, partial confidentiality impact only, no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 17:45 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions that are affected are 25.0-25.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Oracle Siebel CRM is a large-scale enterprise customer relationship management platform with a web-based User Interface layer that serves end-user-facing functionality over HTTP. The affected component falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the UI layer surfaces or transmits accessible data without enforcing proper authorization checks on that data path. The CPE string cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:* covers the full Siebel CRM application product line; affected versions are narrowed to 25.0-25.5 per the Oracle CPU advisory. The vulnerability is reachable over standard HTTP, meaning it requires no special protocol or network position beyond TCP connectivity to the Siebel web tier.

RemediationAI

Apply the Oracle Critical Patch Update for July 2025, available at https://www.oracle.com/security-alerts/cpujul2025.html. Oracle does not publish granular patch version numbers outside the CPU documentation, so consult the advisory for the exact patch identifier and installation instructions applicable to your Siebel 25.x environment. As a compensating control where immediate patching is not feasible, restricting network access to the Siebel web tier - via firewall rules or reverse-proxy ACLs - to authenticated, trusted network segments will reduce exposure, at the cost of limiting legitimate remote end-user access. No workaround is described in the advisory beyond applying the patch.