Oracle Hyperion: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2021-31805 Public exploit Scanner template EPSS 85%

  Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

  The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Apr 12, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text org.apache.commons:commons-text com.guicedee.services:commons-text Debian Ubuntu Maven
  Oct 13, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Hyperion vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixHYP