CVE-2021-2456: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2021-2456 is a critical vulnerability discovered in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. The vulnerability was disclosed on July 20, 2021, and allows unauthenticated attackers with network access via HTTP to potentially take over Oracle Business Intelligence Enterprise Edition (Oracle Advisory, NVD).

The vulnerability exists within BIRemotingServlet component and stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can impact confidentiality, integrity, and availability (ZDI Advisory).

A successful exploitation of this vulnerability can result in complete takeover of Oracle Business Intelligence Enterprise Edition. An attacker can leverage this vulnerability to execute code in the context of Administrator, potentially compromising the confidentiality, integrity, and availability of the system (ZDI Advisory).

The vulnerability is considered easily exploitable by unauthenticated attackers with network access via HTTP. No special conditions or user interaction is required for exploitation (Oracle Advisory, NVD).

Oracle has released security patches to address this vulnerability as part of the July 2021 Critical Patch Update. It is strongly recommended that customers apply these security patches as soon as possible (Oracle Advisory).