Oracle Hyperion Data Relationship Management 11.2.19.0.000 Web Service authorization

Summaryinfo

A vulnerability labeled as critical has been found in Oracle Hyperion Data Relationship Management 11.2.19.0.000. Affected by this vulnerability is an unknown functionality of the component Web Service. Such manipulation leads to privilege escalation. This vulnerability is referenced as CVE-2025-21569. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Oracle Hyperion Data Relationship Management 11.2.19.0.000 and classified as critical. Affected by this issue is an unknown part of the component Web Service. The manipulation with an unknown input leads to a privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). The supported version that is affected is 11.2.19.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

The advisory is shared for download at oracle.com. This vulnerability is handled as CVE-2025-21569 since 12/25/2024. The exploitation is known to be difficult. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/23/2025).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Oracle

Name

• Hyperion Data Relationship Management

Version

• 11.2.19.0.000

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion