Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

The versions of Oracle Business Intelligence Publiosher installed on the remote host is affected by a vulnerability as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported     versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of     this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible     data. (CVE-2023-21941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Publisher (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Security). The supported     version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker     with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data.     (CVE-2023-21970)

  - Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported     versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of     this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible     data. (CVE-2023-21941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity     vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different     classes. (CVE-2019-10172)

  - An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The     OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing     incorrect passwords to indicate they were matching with previously hashed ones that were different.
    (CVE-2020-28052)

  - The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user     from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects     XMLBeans up to and including v2.6.0. (CVE-2021-23926)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174745	Oracle Business Intelligence Publisher 12.2.1.4.0 < 12.2.1.4.230407 (April 2023 CPU)	Nessus	Misc.	medium
174744	Oracle Business Intelligence Publisher 6.4.0.0.0 < 6.4.0.0.230404 (OAS) (April 2023 CPU)	Nessus	Misc.	medium
174742	Oracle Business Intelligence Enterprise Edition (Apr 2023 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-21941

medium

Tenable Plugins

medium

medium

critical