CVE-2022-21492: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server) affecting version 5.9.0.0.0. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. The attack requires human interaction and while the vulnerability exists in Oracle Business Intelligence Enterprise Edition, successful attacks may significantly impact additional products (Oracle Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Confidentiality and Integrity impacts) with the following vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The scoring indicates that the vulnerability is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires user interaction (UI:R), has changed scope (S:C), and can result in low impact to both confidentiality and integrity (C:L, I:L) with no impact on availability (A:N) (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data (NVD).

Oracle has released patches to address this vulnerability as part of the April 2022 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible (Oracle Advisory).