PT-2023-3701 · Oracle · Oracle Essbase

Publicado 2023-07-18 · Atualizado 2023-07-27 · CVE-2023-22010

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Baixa

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Essbase version 21.4.3.0.0

Description The issue is related to insufficient input validation in the Security and Provisioning component of Oracle Essbase. Exploitation of this issue can allow an attacker to gain unauthorized access to protected information via HTTP requests. A successful attack can result in unauthorized read access to a subset of Oracle Essbase accessible data. The attack is considered difficult to exploit and requires a high-privileged attacker with network access via HTTP.

Recommendations For Oracle Essbase version 21.4.3.0.0, consider restricting access to the Security and Provisioning component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-03989

CVE-2023-22010

Produtos afetados

Oracle Essbase

Referências · 6

• https://bdu.fstec.ru/vul/2023-03989 · Nota de Segurança
• https://oracle.com/security-alerts/cpujul2023.html · Aviso do Fabricante
• https://t.me/cvenotify/54572 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22010 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22010 · Nota de Segurança
• https://t.me/cvenotify/55340 · Publicação no Telegram