Unauthenticated Access Vulnerability in Oracle Essbase Analytic Provider Services
CVE-2021-2435

8.1HIGH

Key Information:

Vendor

Oracle
Status
Hyperion Analytic Provider Services
Vendor
CVE Published:
20 July 2021

What is CVE-2021-2435?

This vulnerability in Oracle Essbase Analytic Provider Services allows an unauthenticated attacker to exploit the system via HTTP. Although it requires human interaction for successful attacks, it can lead to unauthorized creation, deletion, or modification of critical data. Overall, it poses significant risks, as attackers may gain complete access to sensitive information crucial to Essbase services.

Affected Version(s)

Hyperion Analytic Provider Services 11.1.2.4

References

https://www.oracle.com/security-alerts/cpujul2021.html
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.