Vulnerability in Oracle Business Intelligence Enterprise Edition by Oracle

CVE-2023-21892

Summary

An improper access control vulnerability exists in Oracle Business Intelligence Enterprise Edition, specifically within the Visual Analyzer component. This flaw allows an attacker with low privileges and network access via HTTP to exploit the system, requiring human interaction for successful exploitation. The impact of this vulnerability may extend beyond Oracle Business Intelligence to affect related products, leading to unauthorized actions such as data updates, insertions, deletions, or read access to sensitive data. Organizations utilizing affected versions (5.9.0.0.0 and 6.4.0.0.0) should take immediate action to mitigate risks associated with potential data compromise.

References