Oracle BI Publisher Vulnerability Allows Low-Privileged Attacks on Data

CVE-2024-20980

Summary

A vulnerability exists within the Oracle BI Publisher component of Oracle Analytics, specifically affecting versions 6.4.0.0.0 and 7.0.0.0.0. This vulnerability can be exploited by a low-privileged attacker who has network access through HTTP, requiring human interaction for successful exploitation. Although directly related to Oracle BI Publisher, the implications of this vulnerability extend to other products, highlighting a significant scope change. Successful exploitation can lead to unauthorized operations, impacting both the confidentiality and integrity of accessible data, allowing malicious actors to perform updates, inserts, or deletions, as well as gain unauthorized read access to data within Oracle BI Publisher.

References