CVE-2024-21084

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Service Gateway). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:::::::*
	cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:::::::*

History

29 May 2025, 19:23

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html - Vendor Advisory
First Time		Oracle bi Publisher Oracle
CPE		cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:::::::* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:::::::*

21 Nov 2024, 08:53

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html -

03 Jul 2024, 01:46

Type	Values Removed	Values Added
CWE		CWE-284

17 Apr 2024, 12:48

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-16 22:15

Updated : 2025-05-29 19:23

NVD link : CVE-2024-21084

Mitre link : CVE-2024-21084

CVE.ORG link : CVE-2024-21084

JSON object : View

Products Affected

oracle

bi_publisher

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-21084", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-04-16T22:15:28.120", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Service Gateway). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle BI Publisher de Oracle Analytics (componente: Service Gateway). Las versiones compatibles que se ven afectadas son 7.0.0.0.0 y 12.2.1.4.0. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP comprometa Oracle BI Publisher. Si bien la vulnerabilidad est\u00e1 en Oracle BI Publisher, los ataques pueden afectar significativamente a productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle BI Publisher. CVSS 3.1 Puntaje base 5.8 (Impactos en la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)."}], "lastModified": "2025-05-29T19:23:11.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F59017DC-0258-45BD-89E4-DC8EBA922107"}, {"criteria": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "274A0CF5-41E8-42E0-9931-F7372A65B9C4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}