WaratekVRT Sign in

CVE-2020-14864 Oracle Business Intelligence Enterprise Edition

Affected softwareOracle Business Intelligence Enterprise Edition
Affected versions5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
Severity7.5 High CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update October 2020
WeaknessPath traversal (CWE-22)
Published21 Oct 2020
Updated17 Jun 2026

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-01-18 · remediation due 2022-07-18 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · honeypot sightings · earliest 2022-01-18.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Nuclei; first seen 2020-10-28.
  • EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-14864 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 351 days 2024-01-22 to 2026-11-10
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 20 days 2026-04-30 to 2026-11-03
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-01-18
IndexArtifactStarsFirst seen
Exploit-DB Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion 2020-10-28
Nuclei Oracle Fusion - Directory Traversal/Local File Inclusion

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR path-traversal security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-22: Path Traversal.

How to mitigate CVE-2020-14864

Apply the fix in Oracle Critical Patch Update October 2020. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N secalert_us@oracle.com Secondary published
CVSS 2.0 7.8 none AV:N/AC:L/Au:N/C:C/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Fusion Middleware / Installation (5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Installation 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0 5.5.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle business intelligence generic 5.5.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0

References

URLTags
http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuoct2020.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864 US Government Resource

Timeline
Published2020-10-21By the CVE Program.
Added to CISA KEV2022-01-18Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2022-01-18Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.