Vulnerabilities > CVE-2019-2861 - XXE vulnerability in Oracle Hyperion Planning 11.1.2.4

047910
CVSS 4.2 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
HIGH
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
high complexity
oracle
CWE-611
exploit available
NVD
Published: 2019-07-23
Updated: 2020-08-24

Summary

Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).

Vulnerable Configurations

Part Description Count
Application
Oracle
1

Common Weakness Enumeration (CWE)

Exploit-Db

idEDB-ID:47196
last seen2019-07-31
modified2019-07-31
published2019-07-31
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/47196
titleOracle Hyperion Planning 11.1.2.3 - XML External Entity

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/153841/oraclehp11123-xml.txt
idPACKETSTORM:153841
last seen2019-08-01
published2019-07-31
reporterLucas Dinucci
sourcehttps://packetstormsecurity.com/files/153841/Oracle-Hyperion-Planning-11.1.2.3-XML-Injection.html
titleOracle Hyperion Planning 11.1.2.3 XML Injection

References