Vulnerability in Oracle Hyperion Essbase Administration Services

CVE-2021-2349

Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that are affected are 11.1.2.4 and 21.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase Administration Services. While the vulnerability is in Hyperion Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

EPSS: 0.017 (74.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2021-2349?
CVE-2021-2349 is a high-severity vulnerability in Oracle Hyperion Essbase Administration Services. CVSS score: 8.6/10. Published 2021-07-21.
How severe is CVE-2021-2349?
High severity. CVSS v3 base score is 8.6 out of 10.
Is CVE-2021-2349 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.