SB2022102030 - Multiple vulnerabilities in Oracle BI Publisher
Published: October 20, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2022-25647)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data passed to writeReplace() method. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.
2) Information disclosure (CVE-ID: CVE-2021-40690)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. A remote attacker can abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
3) Improper input validation (CVE-ID: CVE-2022-21590)
The vulnerability allows a remote authenticated user to read, manipulate or delete data.
The vulnerability exists due to improper input validation within the Core Formatting API component in Oracle BI Publisher. A remote authenticated user can exploit this vulnerability to read, manipulate or delete data.
Remediation
Install update from vendor's website.