CVE-2020-14864: high-severity vulnerability in Oracle Corporation Business Intelligence…
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 7.5epss 97%
from disclosure to weapon7 days
Published on NVDOct 21
1st PoC+7d
CISA KEV+454d
exploitation probability
97%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2022-07-18
Apply updates per vendor instructions.
In short
A flaw in Oracle Business Intelligence Enterprise Edition allows attackers on the network to access sensitive data without logging in. This happens through the installation component and can expose all data the system contains.
Technical detail
An unauthenticated network-based vulnerability in Oracle BIEE (versions 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0) via HTTP with low attack complexity (AC:L) and no user interaction required. Exploitation results in high confidentiality impact, exposing critical data accessible to the application.
Summary generated and translated by AI from the official description.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).