PT-2022-3118 · Oracle · Oracle Business Intelligence Enterprise Edition

Anhnh + 3 · Published 2022-04-19 · Updated 2022-04-28 · CVE-2022-21492

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 5.9.0.0.0

Description The issue is related to a buffer read overflow in the Analytics Server component of Oracle Business Intelligence Enterprise Edition, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data.

Recommendations For version 5.9.0.0.0, consider restricting access to the Analytics Server component until a patch is available. As a temporary workaround, limit HTTP requests to the affected system to minimize the risk of exploitation. Avoid using the affected Oracle Business Intelligence Enterprise Edition version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-03793

CVE-2022-21492

Affected Products

Oracle Business Intelligence Enterprise Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-21492 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03793 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21492 · Vendor Advisory
• https://t.me/cibsecurity/41124 · Telegram Post