PT-2021-21049 · Oracle · Oracle Essbase

Guillaume Jacques + 2 · Published 2021-10-20 · Updated 2022-03-31 · CVE-2021-35653

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Essbase versions prior to 11.1.2.4.046 Oracle Essbase versions prior to 21.3

Description: The issue allows a low-privileged attacker with network access via HTTP to compromise Essbase Administration Services, potentially resulting in unauthorized access to critical data or complete access to all accessible data. While the vulnerability is in Essbase Administration Services, attacks may significantly impact additional products.

Recommendations: For Oracle Essbase versions prior to 11.1.2.4.046, update to version 11.1.2.4.046 or later. For Oracle Essbase versions prior to 21.3, update to version 21.3 or later.

Fix

Related Identifiers

CVE-2021-35653

Affected Products

Oracle Essbase

References · 5

• https://oracle.com/security-alerts/cpuoct2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35653 · Security Note
• https://t.me/cvenotify/25706 · Telegram Post
• https://t.me/cibsecurity/30881 · Telegram Post