Arbitrary Code Execution Vulnerability in Oracle Essbase Administration Services
CVE-2021-35683

9.9CRITICAL

Key Information:

Vendor
Oracle
Status
Hyperion Essbase Administration Services
Vendor
CVE Published:
19 January 2022

Summary

A vulnerability in the Oracle Essbase Administration Services allows a low-privileged attacker with network access via HTTP to execute arbitrary code. This security issue affects the EAS Console component of Oracle Essbase and could lead to unauthorized control over the system. Successful exploitation can jeopardize the confidentiality, integrity, and availability of the affected product, significantly impacting related services.

Affected Version(s)

Hyperion Essbase Administration Services < 11.1.2.4.047

References

https://www.oracle.com/security-alerts/cpujan2022.html
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.