CVE-2021-2005: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

The vulnerability (CVE-2021-2005) affects Oracle Business Intelligence Enterprise Edition (OBIEE) component: BI Platform Security, versions 12.2.1.3.0 and 12.2.1.4.0. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition, requiring human interaction from a person other than the attacker (Oracle Advisory).

The vulnerability has a CVSS 3.1 Base Score of 4.7 (Confidentiality impacts) with the following vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. This indicates a network-based attack vector with low attack complexity, requiring no privileges but user interaction, with changed scope and low impact on confidentiality (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is classified as easily exploitable by unauthenticated attackers with network access via HTTP. However, successful exploitation requires human interaction from a person other than the attacker (Oracle Advisory).

Oracle has released patches to address this vulnerability as part of the January 2021 Critical Patch Update. Users are strongly recommended to apply these security patches as soon as possible (Oracle Advisory).