CVE-2024-21195
Estado: ModificadaAlta (7.6)—
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.
Leer descripción completaMostrar menos
Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- Puntuación base: 7.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.44%
- Percentil entre todas las CVEs puntuadas: 36
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement60 %
Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
- CWE-284
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-21195",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-21195",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-17T13:47:08.043354Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert_us@oracle.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 4.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "secalert_us@oracle.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor": "Oracle Corporation",
"product": "Oracle BI Publisher",
"versions": [
{
"status": "affected",
"version": "7.0.0.0.0"
},
{
"status": "affected",
"version": "7.6.0.0.0"
},
{
"status": "affected",
"version": "12.2.1.4.0"
}
]
}
]
}
],
"published": "2024-10-15T20:15:06.930",
"references": [
{
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle BI Publisher de Oracle Analytics (componente: Plantillas de diseño). Las versiones compatibles afectadas son 7.0.0.0.0, 7.6.0.0.0 y 12.2.1.4.0. Esta vulnerabilidad, que se puede explotar fácilmente, permite que un atacante con pocos privilegios y acceso a la red a través de HTTP ponga en peligro Oracle BI Publisher. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado un acceso no autorizado a datos críticos o un acceso completo a todos los datos accesibles de Oracle BI Publisher, así como una actualización, inserción o eliminación no autorizada de algunos de los datos accesibles de Oracle BI Publisher y la capacidad no autorizada de provocar una denegación de servicio parcial (DOS parcial) de Oracle BI Publisher. Puntuación base CVSS 3.1 7.6 (impactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)."
}
],
"lastModified": "2026-06-17T07:08:42.967",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F59017DC-0258-45BD-89E4-DC8EBA922107"
},
{
"criteria": "cpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB270CE9-4B22-4AF9-9CF6-92B078B644EF"
},
{
"criteria": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "274A0CF5-41E8-42E0-9931-F7372A65B9C4"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert_us@oracle.com"
}