CVE-2023-22010: 
Oracle Essbase vulnerability analysis and mitigation

A vulnerability was identified in Oracle Essbase (component: Security and Provisioning) version 21.4.3.0.0. This security flaw allows high-privileged attackers with network access via HTTP to potentially compromise Oracle Essbase, resulting in unauthorized read access to a subset of Oracle Essbase accessible data (Oracle CPU Jul 2023, NVD Database).

The vulnerability has been assigned a CVSS 3.1 Base Score of 2.2 (Low severity) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. This scoring indicates that while the vulnerability is network-accessible (AV:N), it requires high attack complexity (AC:H) and high privileges (PR:H) to exploit. The impact is limited to confidentiality (C:L), with no impact on integrity or availability (Oracle CPU Jul 2023).

The successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. The impact is primarily focused on confidentiality, with no reported effects on system integrity or availability (NVD Database).

The vulnerability is difficult to exploit and requires high privileges along with network access via HTTP. An attacker would need to have significant access rights and technical capabilities to successfully exploit this vulnerability (Oracle CPU Jul 2023).

Oracle has addressed this vulnerability in their July 2023 Critical Patch Update. Users running Oracle Essbase version 21.4.3.0.0 should apply the security patches provided in this update to mitigate the risk (Oracle CPU Jul 2023).