PT-2021-7182 · Oracle · Hyperion Infrastructure Technology

Paul Barbé · Published 2021-07-20 · Updated 2021-07-26 · CVE-2021-2445

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.5.0

Description The issue is related to insufficient input validation in the Lifecycle Management component. It allows a high-privileged attacker with network access via HTTP to compromise Hyperion Infrastructure Technology, but successful attacks require human interaction from a person other than the attacker. This can result in unauthorized creation, deletion, or modification access to critical data or all Hyperion Infrastructure Technology accessible data, as well as unauthorized access to critical data or complete access to all Hyperion Infrastructure Technology accessible data.

Recommendations For version 11.2.5.0, consider restricting access to the Lifecycle Management component to minimize the risk of exploitation until a patch is available. Additionally, ensure that all inputs are thoroughly validated to prevent unauthorized data access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03665

CVE-2021-2445

Affected Products

Hyperion Infrastructure Technology

References · 4

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2445 · Security Note
• https://bdu.fstec.ru/vul/2022-03665 · Security Note