PT-2023-4024 · Oracle · Oracle Hyperion Workspace

Przemysław Mazurek · Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-22060

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Workspace version 11.2.13.0.000

Description The issue is related to insecure privilege management in the UI and Visualization component of Oracle Hyperion Workspace. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Hyperion Workspace. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized access to critical data and the ability to cause a partial denial of service.

Recommendations For Oracle Hyperion Workspace version 11.2.13.0.000, consider applying security patches or updates to fix the vulnerability, as no specific workaround is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

BDU:2023-04322

CVE-2023-22060

Affected Products

Oracle Hyperion Workspace

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-22060 · Security Note
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22060 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04322 · Security Note
• https://vuldb.com/?id.234881 · Note
• https://t.me/cvenotify/54580 · Telegram Post
• https://t.me/cvenotify/54586 · Telegram Post