CVE-2024-20913: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. This vulnerability allows low privileged attackers with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. The vulnerability was discovered by Mateusz Klement and was disclosed in Oracle's January 2024 Critical Patch Update (Oracle CPU).

The vulnerability requires human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Confidentiality and Integrity impacts) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

Successful exploitation can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data (Oracle CPU).

Oracle has released patches to address this vulnerability as part of the January 2024 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible (Oracle CPU).