CVE-2021-2349

Name of the Vulnerable Software and Affected Versions Oracle Essbase versions 11.1.2.4 and 21.2

Description The issue is related to insufficient input validation in the EAS Console component of Oracle Essbase Administration Services. This allows an unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase Administration Services, potentially leading to unauthorized access to critical data or complete access to all accessible data.

Recommendations For version 11.1.2.4, update to a version that addresses the insufficient input validation issue. For version 21.2, update to a version that addresses the insufficient input validation issue. As a temporary workaround, consider restricting access to the EAS Console component to minimize the risk of exploitation.