CISA Known Exploited Vulnerability

CVE-2020-14864

Oracle · Intelligence Enterprise Edition

Oracle Business Intelligence Enterprise Edition Path Transversal

Date added 2022-01-18

BOD 22-01 due date 2022-07-18

CWE CWE-22

Ransomware Unknown

CISA description

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

Required action

Apply updates per vendor instructions.

Notes & references

https://nvd.nist.gov/vuln/detail/CVE-2020-14864

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2020-14864
CVE.org · CVE-2020-14864
CISA KEV catalog (canonical)