Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:17:29.300Z",
  "pubdate": "2026-08-18T21:17:29.300Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows unauthenticated remote attackers with network access via the HTTP protocol to compromise the affected application.\nSuccessful exploitation of this vulnerability requires human interaction from a victim other than the attacker, such as tricking a user into interacting with a malicious payload or crafted link. The impact of a successful attack compromises both data confidentiality and data integrity, resulting in unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to specific Oracle Hyperion Financial Reporting data.\nThe vulnerability carries a CVSS 3.1 Base Score of 5.4 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating low attack complexity and no privileges required, though constrained by the necessity of user interaction. The risk implications include potential data tampering and exposure of sensitive financial reporting information, necessitating prompt defensive measures.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The application exposes network-accessible endpoints via the HTTP protocol that fail to adequately sanitize or validate input and handle request parameters securely, or alternatively, properly enforce access controls during HTTP interactions.\nExploitation is conducted remotely over the network via HTTP without requiring any pre-existing authentication or elevated privileges, maintaining a low attack complexity. However, successful execution mandates human interaction, implying that the attack vector likely relies on client-side vectors such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), or induced navigation where a authenticated or interacting user unwittingly triggers malicious requests against the vulnerable server.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious HTTP request or payload targeted at the vulnerable Oracle Hyperion Financial Reporting Server component. Second, the attacker induces human interaction by leveraging social engineering or web-based vectors to cause a victim user to execute or submit the crafted request within their active session context. Third, the server processes the HTTP request, bypassing intended validation or security checks due to the flaw.\nUpon successful processing, the payload alters or exposes application data. The post-exploitation impact includes unauthorized read access to a subset of sensitive data accessible by Oracle Hyperion Financial Reporting, alongside unauthorized update, insertion, or deletion of data within the application repository or database, while system availability (A) remains unaffected."
}