CVE-2024-21139: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). The vulnerability affects versions 7.0.0.0.0, 7.6.0.0.0, and 12.2.1.4.0. This is an easily exploitable vulnerability that allows low privileged attackers with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. The vulnerability requires human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requires low privileges (PR:L), and user interaction (UI:R). The scope is changed (S:C), with low impacts to both confidentiality (C:L) and integrity (I:L), but no impact to availability (A:N) (Oracle CPU).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data (Oracle CPU).

The vulnerability is considered easily exploitable but requires both low-level privileges and human interaction from a person other than the attacker. The attack vector is network-based via HTTP protocol (Oracle CPU).

Oracle strongly recommends that customers apply Critical Patch Update security patches without delay. The patches are available for Oracle Business Intelligence Enterprise Edition versions 7.0.0.0.0, 7.6.0.0.0, and 12.2.1.4.0 (Oracle CPU).