Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:45.817Z",
  "pubdate": "2026-08-18T21:17:45.817Z",
  "executiveSummary": "An unauthenticated, network-accessible vulnerability exists within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This security flaw allows remote adversaries without prior authentication or special privileges to bypass security controls over the HTTP protocol.\nSuccessful exploitation of this vulnerability yields severe confidentiality impacts, granting unauthorized read access to critical enterprise data or complete access to all data accessible via Oracle Hyperion Data Relationship Management. The vulnerability is characterized by a CVSS 3.1 Base Score of 7.5 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, highlighting its low attack complexity and the absence of user interaction requirements.\nThe risk implications include significant exposure of sensitive master data management repositories, potential regulatory non-compliance, and unauthorized reconnaissance of corporate hierarchy and dimensional metadata. Mitigation requires applying vendor-supplied updates or implementing strict network segmentation and access controls to restrict unauthorized HTTP exposure.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from improper authorization enforcement or missing access control checks within the application's HTTP request handling logic, enabling external entities to interact with protected endpoints without establishing a valid authenticated session.\nExploitation is conducted remotely over the network using standard HTTP requests. Because the attack vector is network-based (AV:N), the affected service must be reachable via standard web traffic ports. The attack complexity is low (AC:L), meaning no specialized race conditions, memory corruption techniques, or complex environmental prerequisites are required to trigger the flaw. Furthermore, the attack requires zero privileges (PR:N) and zero user interaction (UI:N), allowing automated scanning tools or malicious scripts to directly probe and extract data.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request targeting vulnerable endpoints within the Access and security component of Oracle Hyperion Data Relationship Management. Second, due to the absence of proper authentication and authorization validations, the application processes the incoming request instead of rejecting it. Third, the backend service queries or exposes sensitive dimensional data, hierarchies, and master records stored within the repository. Finally, the server returns the requested critical data in the HTTP response body to the unauthorized client.\nThe post-exploitation impact is strictly confined to confidentiality (C:H), resulting in the unauthorized disclosure of critical data or complete exposure of all information accessible through the Oracle Hyperion Data Relationship Management instance. Integrity (I:N) and Availability (A:N) metrics remain unaffected, as the flaw does not inherently provide mechanisms for data modification, destruction, or denial of service."
}