PT-2024-6952 · Oracle · Oracle Bi Publisher

Alberto Bruscino

·

Published

2024-10-15

·

Updated

2024-10-18

·

CVE-2024-21195

CVSS v2.0

8.0

High

VectorAV:N/AC:L/Au:S/C:C/I:P/A:P
Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 7.0.0.0.0 through 7.6.0.0.0 Oracle BI Publisher version 12.2.1.4.0
Description The issue is related to insufficient input validation in the Layout Templates component of Oracle BI Publisher. This can be exploited by a remote attacker to gain read, modify, or delete access to data. Successful attacks can result in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, as well as unauthorized update, insert, or delete access to some data. It may also lead to a partial denial of service.
Recommendations For Oracle BI Publisher versions 7.0.0.0.0 through 7.6.0.0.0, update to a version that includes the fix for this issue. For Oracle BI Publisher version 12.2.1.4.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Layout Templates component until a patch is available.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-284CWE-20

Related Identifiers

BDU:2024-08201
CVE-2024-21195

Affected Products

Oracle Bi Publisher