PT-2022-2348 · Oracle · Oracle Essbase

Published 2022-01-19 · Updated 2022-01-20 · CVE-2021-35683

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Essbase versions prior to 11.1.2.4.047

Description The issue is related to insufficient input validation in the EAS Console component of Oracle Essbase Administration Services. This allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase Administration Services. Successful attacks can result in the takeover of Oracle Essbase Administration Services and may significantly impact additional products.

Recommendations For versions prior to 11.1.2.4.047, update to version 11.1.2.4.047 or later to resolve the issue. As a temporary workaround, consider restricting access to the EAS Console component via HTTP to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02656

CVE-2021-35683

Affected Products

Oracle Essbase

References · 6

• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35683 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35683 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02656 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022012304 · Note
• https://t.me/cibsecurity/35855 · Telegram Post