CVE-2021-2013: 
Oracle Analytics Publisher vulnerability analysis and mitigation

The vulnerability (CVE-2021-2013) affects Oracle BI Publisher product of Oracle Fusion Middleware, specifically in the BI Publisher Security component. The affected versions include 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. This vulnerability was discovered by Bui Duong from Viettel Cyber Security and was disclosed in January 2021 (Oracle Advisory).

The vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP to compromise Oracle BI Publisher. The vulnerability has been assigned a CVSS 3.1 Base Score of 7.6 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, unauthorized update, insert or delete access to some Oracle BI Publisher accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher (NVD).

The vulnerability is considered easily exploitable by attackers with low privileges and network access through HTTP. No user interaction is required for exploitation (NVD).

Oracle has released security patches to address this vulnerability as part of their January 2021 Critical Patch Update. It is strongly recommended that customers apply these security patches as soon as possible (Oracle Advisory).