Cyber Resilience

CVE-2025-30698

Oracle Jre 1.8.0 … 24

Published
15 April 2025
Modified
03 November 2025
Patch / advisory
CVSS Score v3.1 5.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0059 45th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-30698 is a medium-severity Improper Access Control (CWE-284) vulnerability in Oracle Jre. Its CVSS base score is 5.6 (Medium).

Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-18 (Mobile Code) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:…

more

17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-53057Same product: Oracle Graalvm
CVE-2025-21587Same product: Oracle Graalvm
CVE-2025-61748Same product: Oracle Graalvm
CVE-2025-50059Same product: Oracle Graalvm
CVE-2025-30754Same product: Oracle Graalvm
CVE-2024-20932Same product: Oracle Graalvm
CVE-2025-30691Same product: Oracle Graalvm For Jdk
CVE-2024-21145Same product: Oracle Graalvm
CVE-2026-60331Same vendor: Oracle
CVE-2026-60562Same vendor: Oracle

Affected Assets

oracle
jre
1.8.0, 11.0.26, 17.0.14, 21.0.6, 24
oracle
jdk
1.8.0, 11.0.26, 17.0.14, 21.0.6, 24
oracle
graalvm for jdk
17.0.14, 21.0.6, 24
oracle
graalvm
20.3.17, 21.3.13

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.3.5

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly restricts use of mobile code technologies such as Java applets/Web Start that load untrusted code and rely on the Java sandbox.

prevent

Enforces the sandbox access control policy that this vulnerability attempts to bypass for untrusted network code.

prevent

Disables or limits non-essential Java client capabilities (applets, Web Start) that expose the vulnerable 2D component to untrusted code.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces policy-based access management and least privilege, eliminating most improper-access-control defects, yet CWE-284 also covers implementation flaws and design gaps outside a single management control.

PR.PS-01 mostly match
prevents

Hardened baselines and deviation monitoring directly eliminate most configuration-induced access-control defects, yet CWE-284 also encompasses code-level and design flaws outside the scope of configuration management alone.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most access-control defects during design/coding/testing (mostly), yet leave residual risk from runtime configuration, architecture, and operational controls (partial).

PR.AA-01 partial match
prevents

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

PR.AA-03 partial match
prevents

Authentication directly blocks unauthenticated actors (partial prevention of CWE-284) but leaves authorization logic, policy enforcement, and role checks untouched, so the control neither eliminates nor fully mitigates the broader weakness.

PR.DS-01 partial match
prevents

PR.DS-01 encryption mitigates impact of failed access checks on stored data but neither implements nor constrains access-control logic itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.

prevents

Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.

prevents

By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.

prevents

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

prevents

By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.

prevents

Physical entry controls enforce explicit authorization and authentication at every access point, directly stopping unauthorized actors from reaching information-processing assets.

References