CVE-2024-20904
First published: Tue Jan 16 2024(Updated: )
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Business Intelligence Enterprise Edition | =6.4.0.0.0 | |
| Oracle Business Intelligence Enterprise Edition | =12.2.1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20904?
CVE-2024-20904 is classified as an easily exploitable vulnerability that allows low privileged attackers to compromise Oracle Business Intelligence.
How do I fix CVE-2024-20904?
To fix CVE-2024-20904, update your Oracle Business Intelligence to the latest patched version provided by Oracle.
Which versions of Oracle Business Intelligence are affected by CVE-2024-20904?
CVE-2024-20904 affects Oracle Business Intelligence Enterprise Edition versions 6.4.0.0.0 and 12.2.1.4.0.
Can I exploit CVE-2024-20904 remotely?
Yes, CVE-2024-20904 can be exploited remotely by attackers with low privileges via HTTP access.
What component is impacted by CVE-2024-20904?
CVE-2024-20904 impacts the Pod Admin component of the Oracle Business Intelligence Enterprise Edition.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle business intelligence enterprise edition
- version/oracle business intelligence enterprise edition/6.4.0.0.0
- version/oracle business intelligence enterprise edition/12.2.1.4.0