CVE-2020-14864

🗓️ 21 Oct 2020 14:04:29Reported by oracleType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1024 Views🌐 WEB

Vulnerability in Oracle Business Intelligence Enterprise Edition allows unauthenticated attacker to compromise the system

Reporter	Title	Published	Views	Family All 22
ATTACKERKB	CVE-2020-14864	21 Oct 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software platform allows a perpetrator to gain unauthorized access to protected information.	13 Nov 202000:00	–	bdu_fstec
Circl	CVE-2020-14864	14 Jun 202321:10	–	circl
CISA KEV Catalog	Oracle Business Intelligence Enterprise Edition Path Transversal	18 Jan 202200:00	–	cisa_kev
CISA	CISA Adds 13 Known Exploited Vulnerabilities to Catalog	18 Jan 202200:00	–	cisa
CNVD	Unspecified Vulnerability in Oracle Business Intelligence Enterprise Edition (CNVD-2020-59236)	23 Oct 202000:00	–	cnvd
Check Point Advisories	Oracle Business Intelligence Enterprise Edition Information Disclosure (CVE-2020-14864)	2 Feb 202200:00	–	checkpoint_advisories
Cvelist	CVE-2020-14864	21 Oct 202014:04	–	cvelist
Exploit DB	Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion	28 Oct 202000:00	–	exploitdb
NCSC	Vulnerabilities fixed in Oracle Fusion Middleware	22 Oct 202000:00	–	ncsc

NVD

Vulners

Node

oracle business_intelligenceMatch5.5.0.0.0enterprise

oracle business_intelligenceMatch12.2.1.3.0enterprise

oracle business_intelligenceMatch12.2.1.4.0enterprise

[
  {
    "product": "Business Intelligence Enterprise Edition",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "5.5.0.0.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.3.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.4.0"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
previewFilePath	query param	/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd	Directory traversal/Local File Inclusion via getPreviewImage vulnerability allowing reading arbitrary files.	CWE-22

17 Jun 2026 02:55Current

7High risk

Vulners AI Score7

CVSS 27.8

CVSS 3.17.5

EPSS0.97233

SSVC