CVE-2023-21941: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2023-21941 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically affecting the Web Server component. The vulnerability was disclosed on April 18, 2023, and affects versions 6.4.0.0.0 and 12.2.1.4.0 (Oracle CPU, NVD).

This vulnerability is classified as easily exploitable and requires a low-privileged attacker with network access via HTTP to compromise Oracle BI Publisher. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3, indicating medium severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), which indicates network accessibility, low attack complexity, and low privileges required (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. The impact is primarily limited to confidentiality, with no direct effects on integrity or availability of the system (NVD).

Oracle has released security patches to address this vulnerability as part of their April 2023 Critical Patch Update. Oracle strongly recommends that customers apply the Critical Patch Update security patches as soon as possible due to the threat posed by successful attacks (Oracle CPU).