CVE-2024-21082

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

V

ulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

Link	Resource
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:::::::*
	cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:::::::*

History

26 Mar 2025, 20:15

Type	Values Removed	Values Added
CWE		CWE-611

05 Dec 2024, 15:17

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:::::::* cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:::::::*
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html - Vendor Advisory
First Time		Oracle bi Publisher Oracle

21 Nov 2024, 08:53

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html -

Information

Published : 2024-04-16 22:15

Updated : 2025-03-26 20:15

NVD link : CVE-2024-21082

Mitre link : CVE-2024-21082

CVE.ORG link : CVE-2024-21082

JSON object : View

Products Affected

bi_publisher

CWE

NVD-CWE-noinfo CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2024-21082", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-04-16T22:15:27.780", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle BI Publisher de Oracle Analytics (componente: Servicios XML). Las versiones compatibles que se ven afectadas son 7.0.0.0.0 y 12.2.1.4.0. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP comprometa Oracle BI Publisher. Los ataques exitosos a esta vulnerabilidad pueden resultar en la adquisici\u00f3n de Oracle BI Publisher. CVSS 3.1 Puntuaci\u00f3n base 9,8 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}], "lastModified": "2025-03-26T20:15:18.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F59017DC-0258-45BD-89E4-DC8EBA922107"}, {"criteria": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "274A0CF5-41E8-42E0-9931-F7372A65B9C4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}