CVE-2024-20979: 
Oracle Analytics Publisher vulnerability analysis and mitigation

A vulnerability has been identified in Oracle BI Publisher (component: Web Server) affecting versions 6.4.0.0.0, 7.0.0.0.0, and 12.2.1.4.0. This vulnerability was discovered by Shayan Mashoof Chinjani of Kian Amn Sadra and disclosed in January 2024 (Oracle CPU).

The vulnerability is characterized as easily exploitable and requires low privileges with network access via HTTP to compromise Oracle BI Publisher. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, and user interaction required (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. The scope change indicates that attacks may significantly impact additional products beyond Oracle BI Publisher (Oracle CPU).

Oracle has released patches to address this vulnerability as part of the January 2024 Critical Patch Update. Organizations using affected versions of Oracle BI Publisher (6.4.0.0.0, 7.0.0.0.0, and 12.2.1.4.0) should apply the security patches as soon as possible (Oracle CPU).