CVE-2024-21001: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 7.0.0.0.0. This vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. The vulnerability requires human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (Oracle CPU Apr 2024).

The vulnerability has been assigned a CVSS Base Score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, has low attack complexity, requires low privileges, and needs user interaction. The scope is changed, meaning the vulnerability can affect components beyond its security scope. The vulnerability impacts both confidentiality and integrity at a low level, with no impact on availability (Oracle CPU Apr 2024).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data (Oracle CPU Apr 2024).

The vulnerability is considered easily exploitable and requires network access via HTTP. The attacker needs low privileges and user interaction is required for successful exploitation. The attack can be launched remotely, and while the vulnerability exists in Oracle Business Intelligence Enterprise Edition, successful attacks may significantly impact additional products (Oracle CPU Apr 2024).

Oracle has released patches to address this vulnerability as part of the April 2024 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible due to the threat posed by successful attacks (Oracle CPU Apr 2024).