CVE-2025-30702: Oracle Fleet Patching Disclosure Flaw

CVE-2025-30702 Overview

CVE-2025-30702 is an information disclosure vulnerability in the Fleet Patching and Provisioning (FPP) component of Oracle Database Server. The flaw affects supported versions 19.3 through 19.26. An unauthenticated remote attacker can exploit the vulnerability over HTTP without user interaction. Successful exploitation grants unauthorized read access to a subset of data accessible to Fleet Patching and Provisioning. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Oracle addressed the issue in the April 2025 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can read a subset of Fleet Patching and Provisioning data over HTTP without any user interaction.

Affected Products

Oracle Database Server - Fleet Patching and Provisioning 19.3
Oracle Database Server - Fleet Patching and Provisioning 19.4 through 19.25
Oracle Database Server - Fleet Patching and Provisioning 19.26

Discovery Timeline

2025-04-15 - CVE-2025-30702 published to NVD
2025-04-15 - Oracle releases fix in the April 2025 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30702

Vulnerability Analysis

The vulnerability resides in the Fleet Patching and Provisioning (FPP) component of Oracle Database Server. FPP centralizes lifecycle operations such as provisioning, patching, and upgrading Oracle Grid Infrastructure and database homes across a fleet of servers. The component exposes an HTTP interface used for orchestration and status reporting.

An attacker with network access can reach this interface and retrieve information without providing credentials. The attack complexity is low and no privileges or user interaction are required. Impact is limited to confidentiality — integrity and availability are not affected. According to the CVSS metrics published by Oracle, only a subset of FPP-accessible data is exposed.

Root Cause

The underlying issue is classified as [CWE-200], Exposure of Sensitive Information to an Unauthorized Actor. Oracle's advisory does not publish source-level detail, but the scoring indicates that the affected code path returns data over HTTP without enforcing an authentication or authorization check appropriate for the resource. This design gap allows any network peer to retrieve information the FPP server holds.

Attack Vector

Exploitation requires only network access to the HTTP endpoint exposed by the Fleet Patching and Provisioning service. An attacker sends crafted HTTP requests to the FPP host and parses the responses for sensitive fleet, host, or configuration data. Because no authentication is required and the scope is unchanged, the technique is straightforward to script against exposed FPP servers.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 0.489%. Refer to the Oracle Security Alert April 2025 for vendor-supplied details.

Detection Methods for CVE-2025-30702

Indicators of Compromise

Unexpected HTTP GET requests to Fleet Patching and Provisioning endpoints originating from untrusted networks or unknown source addresses.
Anomalous response sizes or high request volumes against the FPP service port compared with baseline traffic.
Access log entries showing successful HTTP responses to unauthenticated clients for FPP resources.

Detection Strategies

Inspect FPP service and web server access logs for requests without valid session cookies or authentication headers that receive 200 OK responses.
Deploy network intrusion detection signatures that flag HTTP requests targeting known FPP URI paths from external or non-administrative subnets.
Correlate FPP HTTP traffic with the inventory of authorized management hosts to surface requests from unexpected sources.

Monitoring Recommendations

Forward FPP host access logs, Grid Infrastructure alert logs, and network flow data to a centralized SIEM for retention and correlation.
Alert on any inbound HTTP connection to FPP hosts from outside the designated management network segment.
Track the installed patch level of Grid Infrastructure and database homes to confirm the April 2025 CPU fix has been applied fleet-wide.

How to Mitigate CVE-2025-30702

Immediate Actions Required

Apply the April 2025 Critical Patch Update to all Oracle Database Server deployments running Fleet Patching and Provisioning versions 19.3 through 19.26.
Restrict network access to FPP HTTP endpoints so that only authorized administrative hosts can reach the service.
Audit FPP access logs for prior unauthenticated requests that returned data and treat any exposed configuration information as potentially disclosed.

Patch Information

Oracle addressed CVE-2025-30702 in the April 2025 Critical Patch Update. Administrators should install the corresponding Grid Infrastructure and database Release Update (RU) that supersedes version 19.26 for the affected component. Full patch mapping and download links are available in the Oracle Security Alert April 2025.

Workarounds

Place FPP servers behind a firewall or VPN so that the HTTP interface is not reachable from general-purpose or internet-facing networks.
Disable or stop the Fleet Patching and Provisioning service on hosts where it is not actively used until the patch can be applied.
Enforce network segmentation and access control lists that limit FPP HTTP traffic to a small, documented set of administrative source addresses.

bash

# Example: restrict access to the FPP HTTP port to a management subnet using iptables
# Replace <FPP_PORT> and <MGMT_SUBNET> with values for your environment
iptables -A INPUT -p tcp --dport <FPP_PORT> -s <MGMT_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp --dport <FPP_PORT> -j DROP