CVE-2020-14864

CVE-2020-14864 is a high-severity (CVSS 7.5) vulnerability in Oracle Intelligence Enterprise Edition. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 18, 2022. CISA does not currently list it as used in ransomware campaigns. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864