CVE-2019-2770: Medium severity oracle hyperion planning vulnerability

Published Jul 23, 2019

Updated

Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Smart View). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N).

Affected Software

1 affected component

Oracle Hyperion Planning=11.1.2.4

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Event History

Jul 23, 2019

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-2770.

What component of Oracle Hyperion is affected by this vulnerability?

The Oracle Hyperion Planning component, specifically the Smart View subcomponent, is affected by this vulnerability.

What version of Oracle Hyperion Planning is affected by this vulnerability?

The version 11.1.2.4 of Oracle Hyperion Planning is affected by this vulnerability.

How can an attacker exploit this vulnerability?

An attacker with high privileges and network access via HTTP can exploit this vulnerability to compromise Oracle Hyperion Planning.

What is the severity of this vulnerability?

This vulnerability has a severity rating of medium (4.5 on a scale of 1-10).

Where can I find more information about this vulnerability?

You can find more information about this vulnerability in the Oracle Security Advisory CPUJul2019-5072835.