PT-2024-3132 · Oracle · Oracle Bi Publisher

Davide Virruso · Published 2024-04-16 · Updated 2024-12-05 · CVE-2024-21083

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 7.0.0.0.0 through 12.2.1.4.0

Description The issue is related to insufficient input validation in the Script Engine component of Oracle BI Publisher, allowing a high-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in the takeover of Oracle BI Publisher. The vulnerability is easily exploitable and can be used by an attacker to execute arbitrary code.

Recommendations For versions 7.0.0.0.0 through 12.2.1.4.0, consider disabling the Script Engine component until a patch is available to prevent exploitation. Restrict access to the Script Engine component to minimize the risk of exploitation. Avoid using the Oracle BI Publisher product until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BDU:2024-03344

CVE-2024-21083

Affected Products

Oracle Bi Publisher

References · 8

• https://osv.dev/vulnerability/CVE-2024-21083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21083 · Security Note
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03344 · Security Note
• https://twitter.com/CVEnew/status/1780349905959002424 · Twitter Post
• https://twitter.com/cracbot/status/1780495280019792279 · Twitter Post
• https://t.me/cvenotify/103124 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024041728 · Note