PT-2021-7432 · Oracle · Oracle Essbase

Guillaume Jacques + 2 · Published 2021-10-19 · Updated 2022-03-31 · CVE-2021-35652

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Essbase versions prior to 11.1.2.4.046 Oracle Essbase versions prior to 21.3

Description The issue is related to insufficient input validation in the EAS Console component of Oracle Essbase Administration Services. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Essbase Administration Services, potentially leading to a takeover. Attacks may significantly impact additional products.

Recommendations For versions prior to 11.1.2.4.046, update to version 11.1.2.4.046 or later. For versions prior to 21.3, update to version 21.3 or later. As a temporary workaround, consider restricting access to the EAS Console component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-06200

CVE-2021-35652

Affected Products

Oracle Essbase

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-35652 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35652 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06200 · Security Note
• https://t.me/cvenotify/25704 · Telegram Post