ZeroDay Findings
Sign inSign up

Findings

CVE-2020-14864

Oracle Business Intelligence Enterprise Edition Path Transversal

Published Oct 21, 2020 · updated Jun 16, 2026 · oracle business intelligence

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2020 · Catalog

    Detected

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulne

  2. Jan 18, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 18, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulne

Required action

Apply updates per vendor instructions.

CISA due date Jul 18, 2022

Affected

  • cpe oracle/business intelligence12.2.1.3.0
  • cpe oracle/business intelligence12.2.1.4.0
  • cpe oracle/business intelligence5.5.0.0.0
  • vendor Oracle Intelligence Enterprise Editionversion unspecified

Sources

  • CISA KEVCVE-2020-14864

    Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

    cisa.gov
  • CVE.orgCVE-2020-14864

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-14864

    30-day exploitation probability 97.2%

    first.org
  • Exploit Database48964

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2020-14864

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with

    nvd.nist.gov
  • Packet Storm Securitytstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References