LiveActive security incident?Get immediate response
CVE Record

CVE-2021-2347: Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Ma...

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hyperion Infrastructure Technology accessible data as well as unauthorized update, insert or delete access to some of Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N).

MediumCVSS 5.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-2347 affects Oracle Hyperion Infrastructure Technology Lifecycle Management version 11.2.5.0. An already high-privileged attacker with HTTP network access could, with another user’s interaction, gain broad access to sensitive Hyperion data and limited ability to modify data. The issue is moderate because privileges and user interaction are required, but data impact can be serious.

Executive priority

Treat as a scheduled remediation priority for Hyperion environments handling sensitive finance or planning data. It is not currently evidenced as actively exploited, but the confidentiality impact is high if an admin account or privileged pathway is abused.

Technical view

The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N, scored 5.2. The vulnerability is network-reachable over HTTP, low complexity, requires high privileges and user interaction, and can expose critical Hyperion data with limited integrity impact. No CWE is provided in the source bundle.

Likely exposure

Exposure is limited to Oracle Hyperion Infrastructure Technology deployments running supported version 11.2.5.0, especially where Lifecycle Management HTTP interfaces are reachable by privileged users or management networks.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires a high-privileged attacker, network access via HTTP, and interaction by another person, reducing likelihood but not eliminating insider or compromised-admin risk.

Researcher notes

The record identifies product, component, affected version, CVSS vector, and impact, but does not provide CWE, root cause, detailed exploit mechanics, or specific fixed versions in the supplied bundle. Avoid assuming exploit availability or precise remediation beyond Oracle guidance.

Mitigation direction

  • Identify Hyperion Infrastructure Technology 11.2.5.0 deployments.
  • Review Oracle July 2021 Critical Patch Update guidance.
  • Apply Oracle-recommended Hyperion patches or upgrades.
  • Restrict HTTP access to Hyperion management interfaces.
  • Review and minimize high-privilege Hyperion accounts.
  • Monitor privileged Hyperion activity for unusual data access.

Validation and detection

  • Inventory Oracle Hyperion versions and confirm 11.2.5.0 presence.
  • Verify Oracle CPU remediation status for affected systems.
  • Confirm management HTTP endpoints are not broadly reachable.
  • Review privileged account membership and recent usage.
  • Check logs for unusual Lifecycle Management access patterns.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-2347 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.2CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N0.94.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.2Medium
CVSS 3.1 vector shape for CVE-2021-2347Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Oracle CorporationHyperion Infrastructure Technology11.2.5.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.