CVE-2020-14864
Oracle Business Intelligence Enterprise Edition Path Transversal
Description
CVE-2020-14864 is a high-severity path traversal vulnerability in Oracle Business Intelligence Enterprise Edition that allows an unauthenticated attacker to gain unauthorized access to critical data or complete access to all accessible data. The vulnerability exists in the Installation component and affects versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 of Oracle BI Enterprise Edition. An attacker can target the preview FilePath parameter of the getPreviewImage function to traverse directories and read arbitrary system files. CISA has added CVE-2020-14864 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.02% (99.90th percentile), this Oracle path traversal vulnerability has near-certain exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | business intelligence | 5.5.0.0.0; 12.2.1.3.0; 12.2.1.4.0 |
References
- http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html(Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpuoct2020.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Path Traversal occurs when software uses external input to construct a pathname intended to identify a file within a restricted directory, but fails to properly neutralize special elements such as ".." and "/" that can resolve to locations outside the restricted directory. In CVE-2020-14864, the Oracle Business Intelligence Enterprise Edition getPreviewImage function accepts a FilePath parameter that is not properly validated, allowing attackers to use directory traversal sequences to escape the intended directory and read arbitrary files on the system.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact Analysis
CVE-2020-14864 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting significant risk to organizations running Oracle Business Intelligence Enterprise Edition. The vulnerability is remotely exploitable over the network via HTTP with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any attacker with network access. The confidentiality impact is rated HIGH, indicating that successful exploitation provides unauthorized access to critical data or complete access to all Oracle BI Enterprise Edition accessible data, while integrity and availability remain unaffected. The EPSS score of 94.02% (99.90th percentile) indicates near-certain exploitation activity. Organizations running affected Oracle BI Enterprise Edition versions face substantial risk of sensitive data exposure, including configuration files, database credentials, and proprietary business intelligence data stored on the server.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-14864 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-07-18. The EPSS score of 94.02% (99.90th percentile) indicates near-certain exploitation activity. A local file inclusion (LFI) proof-of-concept has been published on Packet Storm Security, providing attackers with ready-to-use exploit details. Given the straightforward nature of path traversal exploitation and the availability of public exploit information, organizations should treat this vulnerability as actively targeted and prioritize immediate remediation.
Remediation
- Apply Oracle Critical Patch Update (CPU) immediately as required by CISA KEV directive. Install the October 2020 CPU from Oracle which addresses CVE-2020-14864 as described in the Oracle Security Alert.
- Verify all Oracle BI Enterprise Edition instances in your environment are updated. Affected versions include 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0. Confirm that patches have been applied to all deployment instances including development, staging, and production environments.
- Implement path traversal mitigations at the network level. Deploy a Web Application Firewall (WAF) with rules to detect and block directory traversal sequences ("../", "..", URL-encoded variants) in request parameters targeting the getPreviewImage endpoint. Restrict network access to the Oracle BI Enterprise Edition application to authorized users and networks only.
- Review server file system for indicators of compromise by examining web server access logs for requests containing directory traversal patterns targeting the getPreviewImage function. Check for evidence of unauthorized file access, particularly attempts to read sensitive configuration files, /etc/passwd, or database credential files.
- Implement file system hardening by running the Oracle BI Enterprise Edition application with minimal file system permissions using a dedicated service account. Apply chroot or containerization to restrict the application's view of the file system, limiting the impact of any successful path traversal exploitation.
Technical Details
CVE-2020-14864 is a path traversal vulnerability (CWE-22) in Oracle Business Intelligence Enterprise Edition affecting the Installation component. The vulnerability exists in the getPreviewImage function which accepts a FilePath parameter that is not properly validated against directory traversal sequences. An attacker can manipulate this parameter with sequences such as "../" to escape the intended directory and read arbitrary files accessible to the Oracle BI Enterprise Edition process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the vulnerability is network-accessible via HTTP, has low attack complexity, requires no authentication or user interaction, and results in high confidentiality impact. Affected versions span Oracle BI Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0, all part of the Oracle Fusion Middleware stack.
Frequently Asked Questions
Is CVE-2020-14864 being actively exploited?
Yes. CVE-2020-14864 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.02% (99.90th percentile) indicates near-certain exploitation activity, and a public proof-of-concept exploit is available.
What products are affected by CVE-2020-14864?
CVE-2020-14864 affects Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0, which are part of Oracle Fusion Middleware. All deployments of these versions are vulnerable until the October 2020 Critical Patch Update is applied.
How do I fix CVE-2020-14864?
Apply the Oracle October 2020 Critical Patch Update (CPU) which addresses CVE-2020-14864. Verify that all Oracle BI Enterprise Edition instances across development, staging, and production environments have been patched. Additionally, deploy WAF rules to block directory traversal attempts as an interim measure.
How severe is CVE-2020-14864?
CVE-2020-14864 has a CVSS 3.1 score of 7.5 (HIGH). The vulnerability enables unauthenticated attackers to read arbitrary files from the server through path traversal, potentially exposing sensitive configuration data, credentials, and business intelligence data. The EPSS score of 94.02% places it among the most actively targeted vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.