Web Server Vulnerability in Oracle BI Publisher by Oracle
CVE-2023-21941

4.3MEDIUM

Key Information:

Vendor

Oracle
Status
Bi Publisher (formerly Xml Publisher)
Vendor
CVE Published:
18 April 2023

What is CVE-2023-21941?

An exploitable vulnerability exists in the Web Server component of Oracle BI Publisher, which is part of Oracle Analytics. This issue allows a low privileged attacker with network access to exploit the vulnerability via HTTP. Successful exploitation can lead to unauthorized read access to specific data within the Oracle BI Publisher system, posing a significant risk to data confidentiality.

Affected Version(s)

BI Publisher (formerly XML Publisher) 6.4.0.0.0

BI Publisher (formerly XML Publisher) 12.2.1.4.0

References

https://www.oracle.com/security-alerts/cpuapr2023.html
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.