Oracle BI Publisher CVE-2025-61754

Exploitation requires network access to the Oracle BI Publisher Web Service API over HTTP and a valid low-privileged account (CVSS PR:L) - it is NOT remote-unauthenticated. The affected deployments are specifically Oracle BI Publisher versions 7.6.0.0.0 and 8.2.0.0.0 with the Web Service API component reachable. Limiting factors: the attacker must first obtain or possess valid (even if minimally privileged) credentials, no user interaction is involved (UI:N) so no social engineering is needed, and impact is confined to unauthorized data disclosure (no integrity or availability effect). The authentication requirement and version-specific exposure substantially narrow the realistic attacker population compared to the network attack vector alone.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable over HTTP and low attack complexity, but it requires an authenticated low-privileged account (PR:L), which is a meaningful barrier to opportunistic mass exploitation. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of critical data, no integrity or availability loss. EPSS is low at 0.33% (24th percentile), indicating no statistical signal of imminent widespread exploitation, which is consistent with the absence of a CISA KEV listing and no identified public POC. The signals are therefore internally consistent - a genuine but not emergency-grade issue whose main driver is the C:H data-exposure impact against enterprise reporting environments. One notable conflict: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L metric and CWE-267 (Privilege Defined With Unsafe Actions), both of which indicate the attacker must already be authenticated and the flaw concerns privilege misuse rather than bypassing authentication - treat the 'Authentication Bypass' label as unreliable and verify against Oracle's advisory.

A user holding a low-privileged but valid Oracle BI Publisher account sends crafted HTTP requests to the Web Service API component and leverages a privilege-definition flaw (CWE-267) to read data they should not be authorized to see, resulting in disclosure of critical or otherwise restricted BI Publisher content. No public exploit code has been identified, so exploitation would currently require independent research or insider access. Because attack complexity is low (AC:L) and no user interaction is needed (UI:N), a motivated authenticated attacker could automate the request once the technique is known.