CVE-2019-2861: XEE

Published Jul 23, 2019

Updated

Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).

Affected Software

1 affected component

Oracle Hyperion Planning=11.1.2.4

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Event History

Jul 23, 2019

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity level of CVE-2019-2861?

The severity level of CVE-2019-2861 is medium with a severity value of 4.2.

What is the affected software for CVE-2019-2861?

The affected software for CVE-2019-2861 is Oracle Hyperion Planning version 11.1.2.4.

How can an attacker exploit CVE-2019-2861?

An attacker with network access via HTTP can exploit CVE-2019-2861 to compromise Oracle Hyperion Planning.

Is there a fix available for CVE-2019-2861?

Yes, Oracle has released a security advisory with fixes for CVE-2019-2861.

What is the Common Weakness Enumeration (CWE) ID for CVE-2019-2861?

The Common Weakness Enumeration (CWE) ID for CVE-2019-2861 is CWE-611.