CVE-2020-14864 - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation)

Back Back to CVE browser

HIGH KEV

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation)

Published Oct 21, 2020 ·Due Jul 18, 2022

7.5

HIGH

CVSS 3.1

EPSS 97.23%

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products

Vendor Oracle Corporation Product Business Intelligence Enterprise Edition Default
n/a
- Version
  12.2.1.3.0
  Status
  affected
  Constraints
  -
- Version
  12.2.1.4.0
  Status
  affected
  Constraints
  -
- Version
  5.5.0.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Business Intelligence Enterprise Edition

n/a

Version	Status	Constraints
12.2.1.3.0	affected	-
12.2.1.4.0	affected	-
5.5.0.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html
x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7000
Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864
government-resourceUS Government Resource
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html		x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7000		Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864		government-resourceUS Government Resource
https://www.oracle.com/security-alerts/cpuoct2020.html		x_refsource_MISCVendor Advisory