CVE-2021-2152: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General) affects versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. This difficult to exploit vulnerability allows high privileged attackers with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker (Oracle Advisory).

The vulnerability has a CVSS v3.1 Base Score of 4.0 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N. The attack requires network access via HTTP, high privileges, and user interaction. The vulnerability impacts both confidentiality and integrity of the system, while availability remains unaffected (Oracle Advisory).

Successful exploitation can result in unauthorized update, insert or delete access to some Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of accessible data. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (Oracle Advisory).

Oracle has released patches for affected versions (5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0) as part of the April 2021 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible (Oracle Advisory).