peter bassill · operator
$ cve CVE-2020-14864 JSON

CVE-2020-14864 KEV EXPLOIT

7.5
HIGH · CVSS 3.1 · EPSS 97.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-07-18.

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Scoring

CVSS7.5 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS97.23% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-22
On CISA KEVyes — remediate by 2022-07-18
Public exploityes
Published2020-10-21
Last modified2026-06-17

CISA KEV

NameOracle Business Intelligence Enterprise Edition Path Transversal
Added2022-01-18
Due2022-07-18
Vendor / productOracle / Intelligence Enterprise Edition
Ransomware usenone reported

Affected (1)

VendorProduct
oraclebusiness intelligence

Public exploits

SourceTitleDate
exploit-dbOracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion2020-10-28

References

→ the Explorer  ·  watch your stack  ·  NVD