oracle business-intelligence CVE-2020-14864 vulnerability in Oracle Products
Published on October 21, 2020

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD

Known Exploited Vulnerability

This Oracle Business Intelligence Enterprise Edition Path Transversal vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

The following remediation steps are recommended / required by July 18, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2020-14864 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Products Associated with CVE-2020-14864

stack.watch emails you whenever new vulnerabilities are published in Oracle Business Intelligence or Oracle. Just hit a watch button to start following.

Oracle Business Intelligence
 
Oracle
 

Affected Versions

Oracle Corporation Business Intelligence Enterprise Edition:

Exploit Probability

EPSS
97.23%
Percentile
99.90%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.