CRITICAL🇵🇱 Wersja polska

CVE-2024-21082

CVSS 9.8v3.1pub. 2024-04-16upd. 2025-03-26

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

🤖 AI Analysis
How it works

An attacker with network access to Oracle BI Publisher can exploit the vulnerability in the XML Services component without needing any credentials. The vulnerability is classified partly as CWE-611 (XML External Entity Injection), which suggests the possibility of processing maliciously crafted XML documents by the vulnerable component. Exploitation is described as easily exploitable, which means a low barrier to entry for a potential attacker.

Impact

Successful exploitation can lead to complete takeover of the Oracle BI Publisher instance, including breach of confidentiality, integrity and availability of data and the system itself. An attacker can gain full control over the application and the data processed by it.

Mitigation & patch

Patches available from the vendor should be applied in accordance with references — Oracle Critical Patch Update from April 2024 (https://www.oracle.com/security-alerts/cpuapr2024.html). Immediate update to patched versions is recommended as well as restricting network access to the Oracle BI Publisher HTTP interface to the minimum necessary sources.

Who is affected

Oracle BI Publisher in versions 7.0.0.0.0 and 12.2.1.4.0 (component: XML Services, Oracle Analytics product)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Oracle Bi Publisher

    APP
    Oracle
    12.2.1.4.07.0.0.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassDoS
CWE
References

Related vulnerabilities

CVE-2026-71059CRITICAL9.9same product

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported ...

CVE-2026-60173CRITICAL9.8PL ✓same product

Krytyczna podatność w Oracle BI Publisher umożliwiająca przejęcie systemu

CVE-2026-60719CRITICAL9.9PL ✓same product

Krytyczna podatność w Oracle BI Publisher — Web Service API

CVE-2017-5645CRITICAL9.8PL ✓same product

Apache Log4j 2.x — RCE poprzez deserializację zdarzeń przez socket server

CVE-2026-61305HIGH8.3same product

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Suppo...