PT-2019-3720 · Oracle · Oracle Hyperion Data Relationship Management

Published 2019-10-15 · Updated 2019-10-18 · CVE-2019-2927

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hyperion Data Relationship Management version 11.1.2.4

Description The issue is related to inadequate access control in the Access and Security component of Hyperion Data Relationship Management, which can be exploited by a remote attacker to cause a denial of service, execute arbitrary code, or gain unauthorized access to sensitive information using the HTTP protocol. The exploitation of this issue is difficult and requires high privileges, as well as human interaction from someone other than the attacker. A successful attack can result in the takeover of Hyperion Data Relationship Management.

Recommendations For version 11.1.2.4, update to a version that includes the fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting access to the Access and Security component to minimize the risk of exploitation. Additionally, restrict HTTP access to the component to reduce the attack surface.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-03947

CVE-2019-2927

Affected Products

Oracle Hyperion Data Relationship Management

References · 5

• https://bdu.fstec.ru/vul/2019-03947 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-2927 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2927 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note