A flaw in Oracle Essbase exposes the Security component to untrusted users over the network, allowing an attacker to insert, update, or delete data and to read restricted data. The vulnerability is rated CVSS 3.1 base score 5.6 with a vector indicating network access, high attack complexity, and no privileges or user interaction are required, reflecting an intentional design weakness causing moderate confidentiality, integrity and availability impact.

Oracle Corporation's Oracle Essbase version 21.8.3.0.0 is affected. No other versions or products are listed by the CNA.

The CVSS score indicates moderate severity, and the EPSS score of < 1% indicates an extremely low exploitation probability, indicating that no recorded field exploitation has been reported. The vulnerability is not listed in the CISA KEV catalogue. It is inferred that an attacker with network connectivity to the T3 or IIOP ports, without needing any credentials, can exploit this weakness. The attack would require simple network access and could lead to unauthorized data changes, read access to sensitive data, and a partial denial of service.