CVE-2020-14864

HIGHCISA KEVNuclei

Oracle Business Intelligence Enterprise Edition Path Transversal

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-14864 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit and 1 Nuclei template. CISA lists CVE-2020-14864 in KEV.

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Jan 18, 2022 · CISA
VulnCheck KEV
Listed · Jan 18, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationActive
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 26, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Intelligence Enterprise Edition

Browse Oracle / Intelligence Enterprise Edition
CISAVersion data not supplied

Business Intelligence Enterprise Edition

Browse Oracle Corporation / Business Intelligence Enterprise Edition
CVE List5.5.0.0.0affected
12.2.1.3.0affected
12.2.1.4.0affected

Proofs of concept

1

Catalogued exploits

ExploitDBOracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File InclusionExploitDB exploitby Ivo PalazzoloNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHOracle Fusion - Directory Traversal/Local File InclusionCVSS 7.5

Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage."

Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or gain unauthorized access to the system.

Remediation

Apply the latest security patches and updates provided by Oracle to fix this vulnerability.

WeaknessesCWE-22
AuthorsIvo Palazzolo (@palaziv)
Template tagscvecve2020oraclelfikevpacketstormvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
Shodan: http.title:"oracle business intelligence sign in"
FOFA: title="oracle business intelligence sign in"
Google: intitle:"oracle business intelligence sign in"
http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html https://www.oracle.com/security-alerts/cpuoct2020.html https://nvd.nist.gov/vuln/detail/CVE-2020-14864 https://github.com/merlinepedra/nuclei-templates https://github.com/sobinge/nuclei-templates

Source: ProjectDiscovery

References

4