PT-2021-6732 · Oracle · Oracle Bi Publisher

Published 2021-08-20 · Updated 2022-01-24 · CVE-2022-21346

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher, resulting in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. The vulnerability is related to the BI Publisher Security component and is easily exploitable. It involves insufficient restriction of XML external entities when processing ReportTemplateService endpoint parameters, which can be exploited by a remote attacker to gain unauthorized access to protected information using a specially crafted document or web page.

Recommendations For version 5.5.0.0.0, update to a version that includes the fix for this issue. For version 12.2.1.3.0, update to a version that includes the fix for this issue. For version 12.2.1.4.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the ReportTemplateService endpoint to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-91

CWE-611

Related Identifiers

BDU:2022-02106

CVE-2022-21346

ZDI-22-123

Affected Products

Oracle Bi Publisher

References · 5

• https://osv.dev/vulnerability/CVE-2022-21346 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-123 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21346 · Security Note
• https://bdu.fstec.ru/vul/2022-02106 · Security Note