PT-2021-7200 · Oracle · Hyperion Essbase Administration Services

Kajetan Rostojek + 1 · Published 2021-07-20 · Updated 2021-07-23 · CVE-2021-2350

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hyperion Essbase Administration Services versions 11.1.2.4 through 21.2

Description The issue exists due to insufficient input validation in the EAS Console component of Oracle Hyperion Essbase Administration Services. This allows a remote attacker to gain unauthorized access to protected information via HTTP requests. Successful attacks can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data.

Recommendations For versions 11.1.2.4 and 21.2, update to a version that includes the fix for this issue to prevent unauthorized access. As a temporary workaround, consider restricting access to the EAS Console component until a patch is available. Avoid using HTTP requests to access sensitive data in Hyperion Essbase Administration Services until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03683

CVE-2021-2350

Affected Products

Hyperion Essbase Administration Services

References · 5

• https://osv.dev/vulnerability/CVE-2021-2350 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2350 · Security Note
• https://bdu.fstec.ru/vul/2022-03683 · Security Note
• https://t.me/cibsecurity/26323 · Telegram Post