## Summary
A vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics), specifically the BI Search component, affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The issue is described as easily exploitable by a low-privileged attacker with logon to the infrastructure where the product runs, potentially leading to takeover of the Oracle Business Intelligence Enterprise Edition.
## Technical Details
- Affected component: BI Search (Oracle Analytics / Oracle Business Intelligence Enterprise Edition).
- Attack characteristics (from NVD):
- Attack vector: LOCAL (AV:L)
- Attack complexity: LOW (AC:L)
- Privileges required: LOW (PR:L)
- User interaction: NONE (UI:N)
- Impact scope: UNCHANGED (S:U)
- CIA impact: C:H, I:H, A:H
- CVSS 3.1: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
## Affected
- Oracle Business Intelligence Enterprise Edition (Oracle Analytics)
- 8.2.0.0.0
- 12.2.1.4.0
- 26.01.0.0.0
## Impact
- Potential takeover of Oracle Business Intelligence Enterprise Edition.
- High impact on confidentiality, integrity, and availability (C:H, I:H, A:H).
## Mitigation
1. Restrict and monitor local access to the infrastructure hosting Oracle Business Intelligence Enterprise Edition, since the vector is LOCAL and requires LOW privileges.
2. Apply vendor-provided patches or updates for the affected BI Search component for versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
3. Review authentication and authorization controls for low-privileged accounts on the host to reduce the likelihood of successful exploitation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H