CVE-2024-20980

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:business_intelligence_publisher:6.4.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_intelligence_publisher:7.0.0.0.0:*:*:*:*:*:*:*

History

27 Nov 2024, 16:37

Type Values Removed Values Added
References () https://www.oracle.com/security-alerts/cpujan2024.html - () https://www.oracle.com/security-alerts/cpujan2024.html - Vendor Advisory
First Time Oracle business Intelligence Publisher
Oracle
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:oracle:business_intelligence_publisher:6.4.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_intelligence_publisher:7.0.0.0.0:*:*:*:*:*:*:*

21 Nov 2024, 08:53

Type Values Removed Values Added
References () https://www.oracle.com/security-alerts/cpujan2024.html - () https://www.oracle.com/security-alerts/cpujan2024.html -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad en el producto Oracle BI Publisher de Oracle Analytics (componente: Web Server). Las versiones compatibles que se ven afectadas son 6.4.0.0.0 y 7.0.0.0.0. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red a través de HTTP comprometer Oracle BI Publisher. Los ataques exitosos requieren la interacción humana de una persona distinta del atacante y, si bien la vulnerabilidad está en Oracle BI Publisher, los ataques pueden afectar significativamente a productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a actualizaciones, inserción o eliminación de algunos de los datos accesibles de Oracle BI Publisher, así como acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle BI Publisher. CVSS 3.1 Puntaje base 5.4 (Impactos en la confidencialidad y la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

17 Feb 2024, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-17 02:15

Updated : 2024-11-27 16:37


NVD link : CVE-2024-20980

Mitre link : CVE-2024-20980

CVE.ORG link : CVE-2024-20980


JSON object : View

Products Affected

oracle

  • business_intelligence_publisher