CVE-2021-2350

Name of the Vulnerable Software and Affected Versions Hyperion Essbase Administration Services versions 11.1.2.4 through 21.2

Description The issue exists due to insufficient input validation in the EAS Console component of Oracle Hyperion Essbase Administration Services. This allows a remote attacker to gain unauthorized access to protected information via HTTP requests. Successful attacks can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data.

Recommendations For versions 11.1.2.4 and 21.2, update to a version that includes the fix for this issue to prevent unauthorized access. As a temporary workaround, consider restricting access to the EAS Console component until a patch is available. Avoid using HTTP requests to access sensitive data in Hyperion Essbase Administration Services until the issue is resolved.