CWE Code: 284
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Improper Access Control
Summary: vulnerability in the hyperion bi+ component of oracle hyperion (subcomponent: foundation ui & servlets). the supported version that is affected is 11.1.2.4. easily exploitable vulnerability allows high privileged attacker with network access via http to compromise hyperion bi+. successful attacks require human interaction from a person other than the attacker. successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of hyperion bi+ accessible data as well as unauthorized read access to a subset of hyperion bi+ accessible data and unauthorized ability to cause a partial denial of service (partial dos) of hyperion bi+. cvss 3.0 base score 4.3 (confidentiality, integrity and availability impacts). cvss vector: (cvss:3.0/av:n/ac:l/pr:h/ui:r/s:u/c:l/i:l/a:l).
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-01-16
Last Modified Date: 2019-01-18