CVE-2022-21508: Medium severity oracle hyperion essbase vulnerability

Published Jul 19, 2022

Updated

Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.3. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N).

Affected Software

1 affected component

Oracle Essbase=21.3

Event History

Jul 19, 2022

CVE Published

via MITRE·09:06 PM

Data Sourced

via MITRE·09:06 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this Oracle Essbase vulnerability?

The vulnerability ID for this Oracle Essbase vulnerability is CVE-2022-21508.

What component of Oracle Essbase is affected by this vulnerability?

This vulnerability affects the Security and Provisioning component of Oracle Essbase.

What is the affected version of Oracle Essbase?

The affected version of Oracle Essbase is 21.3.

What is the severity rating of this vulnerability?

The severity rating of this vulnerability is medium with a CVSS score of 5.8.

How can an attacker exploit this vulnerability?

An attacker with high privileges and logon access to the infrastructure where Oracle Essbase executes can exploit this vulnerability to compromise Oracle Essbase.

Is there a fix available for this vulnerability?

Yes, please refer to the Oracle Security Advisory for information on available patches and updates.