PT-2023-3701 · Oracle · Oracle Essbase

Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-22010

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Essbase version 21.4.3.0.0

Description The issue is related to insufficient input validation in the Security and Provisioning component of Oracle Essbase. Exploitation of this issue can allow an attacker to gain unauthorized access to protected information via HTTP requests. A successful attack can result in unauthorized read access to a subset of Oracle Essbase accessible data. The attack is considered difficult to exploit and requires a high-privileged attacker with network access via HTTP.

Recommendations For Oracle Essbase version 21.4.3.0.0, consider restricting access to the Security and Provisioning component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-03989

CVE-2023-22010

Affected Products

Oracle Essbase

References · 6

• https://bdu.fstec.ru/vul/2023-03989 · Security Note
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22010 · Security Note
• https://t.me/cvenotify/54572 · Telegram Post
• https://t.me/cvenotify/55340 · Telegram Post