Login Sign Up

CVE-2021-2051

7.6 HIGH

📋 TL;DR

This vulnerability in Oracle BI Publisher allows authenticated attackers with low privileges to access, modify, or delete sensitive data, and cause partial denial of service via HTTP requests. It affects Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 within Oracle Fusion Middleware's E-Business Suite - XDO component.

💻 Affected Systems

Products:
  • Oracle BI Publisher
  • Oracle Fusion Middleware
Versions: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
Operating Systems: All platforms running affected Oracle BI Publisher versions
Default Config Vulnerable: ⚠️ Yes
Notes: Affects the E-Business Suite - XDO component specifically. Requires network access via HTTP and low privileged user account.

📦 What is this software?

Business Intelligence Publisher by Oracle

View all CVEs affecting Business Intelligence Publisher →

Business Intelligence Publisher by Oracle

View all CVEs affecting Business Intelligence Publisher →

Business Intelligence Publisher by Oracle

View all CVEs affecting Business Intelligence Publisher →

Business Intelligence Publisher by Oracle

View all CVEs affecting Business Intelligence Publisher →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of all Oracle BI Publisher accessible data including unauthorized access, modification, deletion, and partial service disruption.

🟠

Likely Case

Unauthorized access to sensitive business data and potential data manipulation by authenticated low-privilege users.

🟢

If Mitigated

Limited impact if proper network segmentation, least privilege access, and monitoring are implemented.

🌐 Internet-Facing: HIGH - Network accessible via HTTP with low attack complexity makes internet-facing instances prime targets.
🏢 Internal Only: MEDIUM - Internal attackers with low privileges could still exploit this to access sensitive data.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Oracle describes as 'easily exploitable' with low attack complexity. Requires authenticated access but only low privileges.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update Advisory - January 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpujan2021.html

Restart Required: Yes

Instructions:

1. Download appropriate patch from Oracle Support. 2. Apply patch following Oracle's patching procedures. 3. Restart affected services. 4. Verify patch application.

🔧 Temporary Workarounds

Network Access Restriction

all

Restrict network access to Oracle BI Publisher instances to only trusted IP addresses and networks.

Use firewall rules to limit access: iptables -A INPUT -p tcp --dport [BI_PUBLISHER_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [BI_PUBLISHER_PORT] -j DROP

Least Privilege Enforcement

all

Review and minimize user privileges to only necessary functions for all BI Publisher accounts.

Review user roles in Oracle BI Publisher administration console
Remove unnecessary privileges from low-privilege accounts

🧯 If You Can't Patch

  • Implement strict network segmentation and firewall rules to limit access to BI Publisher instances
  • Enforce strong authentication and monitor all access to BI Publisher for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check Oracle BI Publisher version via administration console or query database for XDO version information.

Check Version:

Check Oracle BI Publisher version in administration interface or via SQL: SELECT * FROM XDO_VERSION;

Verify Fix Applied:

Verify patch application through Oracle patch management tools and confirm version is no longer in affected range.

📡 Detection & Monitoring

Log Indicators:

  • Unusual data access patterns by low-privilege users
  • Multiple failed authentication attempts followed by successful low-privilege access
  • Unexpected data modification or deletion events

Network Indicators:

  • HTTP requests to BI Publisher endpoints from unusual sources
  • Traffic patterns indicating data exfiltration

SIEM Query:

source="oracle_bi_publisher" AND (event_type="data_access" OR event_type="data_modification") AND user_privilege="low"

📊 Metadata

CVE ID: CVE-2021-2051
CVSS v3 Score: 7.6 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Published: January 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON