A vulnerability in Oracle Essbase’s security component permits a low privileged attacker with network access through HTTP to compromise the system. The flaw allows the attacker to read all data accessible to Essbase, leading to a full compromise of confidential information. The description highlights that successful exploitation results in unauthorized disclosure of critical data and can extend beyond Essbase when additional products are involved.

The affected product is Oracle Essbase version 21.8.3.0.0. No other versions or products have been listed as impacted.

The vulnerability carries a CVSS 3.1 base score of 7.7 with a high confidentiality impact. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. Because the exploit requires only low privileges and network access via HTTP, an attacker with those conditions could compromise the system, potentially affecting additional related products. Nonetheless, the likelihood of successful exploitation remains low based on current EPSS data.