CVE-2021-2244 is a critical vulnerability affecting Oracle Hyperion Analytic Provider Services (versions 11.1.2.4, 12.2.1.4) and Oracle Essbase Analytic Provider Services (version 21.2), specifically within their JAPI components. This easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to fully compromise the affected services, leading to complete takeover. With a CVSS 3.1 Base Score of 10.0, it poses severe impacts on confidentiality, integrity, and availability, and while it requires human interaction, attacks can significantly affect additional products. Despite its critical nature and high FAUCET Risk Score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
21.2CPE matchmatch criteria | cpe:2.3:a:oracle:essbase_analytic_provider_services:21.2:*:*:*:*:*:*:* | ||
11.1.2.4CPE matchmatch criteria | cpe:2.3:a:oracle:hyperion_analytic_provider_services:11.1.2.4:*:*:*:*:*:*:* | ||
12.2.1.4CPE matchmatch criteria | cpe:2.3:a:oracle:hyperion_analytic_provider_services:12.2.1.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.