PT-2021-21048 · Oracle · Oracle Essbase

Guillaume Jacques + 2 · Published 2021-10-20 · Updated 2022-03-31 · CVE-2021-35651

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Essbase versions prior to 11.1.2.4.046 Oracle Essbase versions prior to 21.3

Description: The issue allows a low-privileged attacker with network access via HTTP to compromise Essbase Administration Services, potentially impacting additional products. Successful attacks can result in unauthorized access to critical data, complete access to all Essbase Administration Services accessible data, as well as unauthorized update, insert, or delete access to some of the accessible data.

Recommendations: For Oracle Essbase versions prior to 11.1.2.4.046, update to version 11.1.2.4.046 or later. For Oracle Essbase versions prior to 21.3, update to version 21.3 or later.

Fix

Related Identifiers

CVE-2021-35651

Affected Products

Oracle Essbase

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-35651 · Security Note
• https://oracle.com/security-alerts/cpuoct2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35651 · Vendor Advisory
• https://t.me/cvenotify/25707 · Telegram Post