CVE-2025-61754: Oracle BI Publisher Information Disclosure

CVE-2025-61754 Overview

CVE-2025-61754 is an information disclosure vulnerability in the Oracle BI Publisher product of Oracle Analytics. The flaw resides in the Web Service API component and affects supported versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with network access via HTTP can exploit the weakness to gain unauthorized access to critical data. Oracle addressed the issue in the October 2025 Critical Patch Update. The Common Weakness Enumeration classifies the flaw as [CWE-267] Privilege Defined With Unsafe Actions.

Critical Impact

Successful exploitation can result in unauthorized access to all data accessible through Oracle BI Publisher, exposing confidential business reports and analytics content.

Affected Products

• Oracle BI Publisher 7.6.0.0.0
• Oracle BI Publisher 8.2.0.0.0
• Oracle Analytics (BI Publisher component)

Discovery Timeline

• 2025-10-21 - CVE-2025-61754 published to NVD alongside Oracle's October 2025 Critical Patch Update
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61754

Vulnerability Analysis

The vulnerability exists within the Web Service API component of Oracle BI Publisher. Oracle BI Publisher exposes SOAP and REST services used for report generation, scheduling, and administration. The affected API path permits an authenticated low-privileged account to invoke operations that return data beyond the caller's intended authorization scope.

Exploitation requires network reachability to the BI Publisher web endpoint and a valid low-privileged session. No user interaction is required. The impact is limited to confidentiality; integrity and availability of the system remain unaffected. However, BI Publisher instances routinely contain sensitive financial, HR, and operational reports, making confidentiality loss significant.

Root Cause

The issue maps to [CWE-267] Privilege Defined With Unsafe Actions. The Web Service API grants a set of actions to low-privileged roles that should have been restricted to higher-privileged administrators. The privilege model fails to enforce a least-privilege boundary on data-retrieval operations.

Attack Vector

An attacker authenticates to Oracle BI Publisher using any low-privileged account. The attacker then sends crafted HTTP requests to the vulnerable Web Service API endpoint. The service processes these requests without applying the appropriate authorization check and returns data the caller should not access. Because the attack requires only network access and a low-privileged credential, insider threats, credential-stuffing outcomes, and compromised service accounts all present viable exploitation paths.

No public proof-of-concept exploit is available at time of writing, and CISA has not added CVE-2025-61754 to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-61754

Indicators of Compromise

• Unusual HTTP request volume from low-privileged accounts to BI Publisher Web Service API endpoints such as /xmlpserver/services/ and /xmlpserver/ReportTemplateService.
• Report or dataset access events in BI Publisher audit logs performed by accounts that do not typically consume those objects.
• SOAP or REST responses of anomalous size returned to non-administrator sessions.

Detection Strategies

• Enable BI Publisher auditing and forward records to a centralized log platform for correlation across users, endpoints, and report objects.
• Baseline normal API consumption per role, then alert on deviations such as a low-privileged account enumerating multiple report data models.
• Inspect web server and reverse-proxy access logs for repeated calls to Web Service API paths originating from a single low-privileged session.

Monitoring Recommendations

• Monitor authentication logs for successful logins from unexpected geolocations or hosts to Oracle Analytics accounts.
• Track outbound data transfer volumes from the BI Publisher host to detect bulk extraction attempts.
• Review privilege assignments periodically to ensure no low-privileged role retains access to sensitive report catalogs.

How to Mitigate CVE-2025-61754

Immediate Actions Required

• Apply the October 2025 Oracle Critical Patch Update fixes for Oracle BI Publisher versions 7.6.0.0.0 and 8.2.0.0.0.
• Inventory BI Publisher deployments and confirm patch status through the Oracle Opatch utility.
• Rotate credentials for BI Publisher service and application accounts that authenticate to the Web Service API.
• Restrict network exposure of BI Publisher management endpoints to trusted administrative segments only.

Patch Information

Oracle released fixes as part of the October 2025 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - October 2025 for patch bundle identifiers, download locations, and pre-installation prerequisites specific to their BI Publisher release.

Workarounds

• Place BI Publisher behind a web application firewall configured to block unauthorized calls to Web Service API paths.
• Enforce network access control lists so only trusted client subnets can reach the BI Publisher HTTP listener.
• Review and reduce role assignments so that only accounts with a documented need retain access to report data models and datasources.
• Disable unused Web Service API endpoints where operationally feasible until patches are deployed.

# Example: restrict access to BI Publisher web services at the reverse proxy
# nginx snippet limiting Web Service API endpoints to a management subnet
location /xmlpserver/services/ {
    allow 10.20.30.0/24;
    deny  all;
    proxy_pass http://bipublisher-backend;
}