Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T21:18:09.683Z",
  "pubdate": "2026-08-18T21:18:09.683Z",
  "executiveSummary": "An easily exploitable security vulnerability affecting the BI Platform Security component of Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows low-privileged network attackers to compromise the system via HTTP. Successful exploitation of this vulnerability leads to significant confidentiality, integrity, and availability impacts, granting unauthorized access to, as well as the ability to create, delete, or modify, critical data or all accessible data within the application. Additionally, attackers can trigger a partial denial of service condition against the affected platform. The vulnerability carries a CVSS 3.1 Base Score of 8.3 with the vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), highlighting severe risks related to data exposure, data tampering, and service degradation. Exploitation requires network connectivity over HTTP and low-level user privileges, but no user interaction is necessary.",
  "technicalDetails": "The vulnerability resides within the BI Platform Security component of Oracle Business Intelligence Enterprise Edition, specifically impacting version 12.2.1.4.0. The flaw stems from inadequate access controls and authorization enforcement mechanisms within the security architecture handling HTTP requests.\nAttackers initiate the attack flow by leveraging network access via HTTP to target the vulnerable BI Platform Security component. Because the vulnerability requires only low privileges and no user interaction, an authenticated user with minimal access rights can craft malicious HTTP requests designed to bypass intended security boundaries.\nUpon reaching the vulnerable component, the crafted payload exploits flaws in how permissions and access controls are validated during request processing. This failure allows the low-privileged attacker to execute unauthorized operations that should normally be restricted to higher-privileged administrative roles.\nThe post-exploitation impact includes unauthorized creation, deletion, and modification of critical data or all data accessible through Oracle Business Intelligence Enterprise Edition, severely compromising data integrity. Furthermore, the attacker gains unauthorized read access to critical or complete application data, resulting in a severe confidentiality breach. The successful execution of malicious payloads can also overwhelm or disrupt internal processing routines, leading to a partial denial of service state that affects the availability and operational reliability of the Oracle Business Intelligence Enterprise Edition environment."
}