CVE-2023-21941: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2023-21941 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically affecting the Web Server component. The vulnerability was disclosed on April 18, 2023, and affects versions 6.4.0.0.0 and 12.2.1.4.0 (Oracle CPU, NVD).

This vulnerability is classified as easily exploitable and requires a low-privileged attacker with network access via HTTP to compromise Oracle BI Publisher. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3, indicating medium severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), which indicates network accessibility, low attack complexity, and low privileges required (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. The impact is primarily limited to confidentiality, with no direct effects on integrity or availability of the system (NVD).

The vulnerability is characterized as easily exploitable, requiring only network access via HTTP and low-level privileges. No user interaction is needed for exploitation, making it a potentially attractive target for attackers (Oracle CPU).

Oracle has released security patches to address this vulnerability as part of their April 2023 Critical Patch Update. Oracle strongly recommends that customers apply the Critical Patch Update security patches as soon as possible due to the threat posed by successful attacks (Oracle CPU).