CVE DatabaseCVE-2020-14864

Updated 2026-06-17한국어 권고문 →

CVE-2020-148647.5/HIGHCISA KEVCWE-22

Oracle Business Intelligence Enterprise Edition (OBIEE) Directory Traversal & Local File Inclusion (LFI) Vulnerability (CVE-2020-14864) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

oracle_business_intelligence_enterprise_edition

Published Date

2020-10-21

CVSS v3.1

7.5

HIGH

EPSS (30d)

97.2%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

Impact

Unauthenticated remote attackers can access sensitive system files and configuration data via crafted HTTP requests

Mitigation

Apply the official Oracle Critical Patch Update (CPU) or implement path traversal blocking rules on Web Application Firewalls (WAF)

Affected Products & Version Scope

Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official Oracle Critical Patch Update (CPU) using the OPatch utility.

bash

# Set Oracle environment variables
export ORACLE_HOME='/u01/app/oracle/middleware'
export PATH=$ORACLE_HOME/OPatch:$PATH

# Verify patch conflicts before applying
cd /u01/patches/31856644
opatch prereq CheckConflictAgainstOHWithDetail -ph ./

# Apply the patch (Ensure services are stopped)
opatch apply

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, configure a reverse proxy or WAF to block directory traversal patterns.

nginx

# Nginx configuration to block path traversal attempts
server {
    listen 80;
    server_name obiee.internal;

    location / {
        # Block directory traversal sequences
        if ($request_uri ~* "(\.\./|\.\.\\)") {
            return 403 'Access Denied: Directory Traversal Detected';
        }
        proxy_pass http://localhost:9502;
    }
}

3. Log Audit & IoC Verification Commands

Scan OBIEE and WebLogic access logs for potential exploitation attempts.

bash

# Search for directory traversal patterns in access logs
LOG_DIR='/u01/app/oracle/middleware/user_projects/domains/bi/servers/bi_server1/logs'
grep -Ei '(\.\./|\.\.\\|%2e%2e)' $LOG_DIR/*_access.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately apply the Oracle CPU patch or enforce WAF blocking rules.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2020-14864 is a critical Directory Traversal (CWE-22) and Local File Inclusion (LFI) vulnerability in the Installation component of Oracle Business Intelligence Enterprise Edition (OBIEE). Due to insufficient input validation of HTTP request paths, unauthenticated remote attackers can bypass the web root directory restriction to read arbitrary files on the hosting server.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker with network access via HTTP can send a specially crafted GET request containing directory traversal sequences (e.g., '../../' or encoded equivalents). This allows the attacker to retrieve sensitive configuration files, WebLogic credentials, and system files under the privileges of the application process. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Successful exploitation can lead to unauthorized access to critical business intelligence data and middleware configuration files. Exposure of database credentials or WebLogic domain configurations can serve as a stepping stone for lateral movement and full infrastructure compromise, posing severe business continuity risks.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html

Source: secalert_us@oracle.com · Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert_us@oracle.com · Vendor Advisory

http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14864

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2020-14864)

FAQ

Q1. How critical is CVE-2020-14864 and is it actively exploited in the wild?

CVE-2020-14864 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 97.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-14864?

Primary impacted vendors include oracle across oracle_business_intelligence_enterprise_edition. Scope summary: Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

Q3. What temporary mitigations or workarounds exist for CVE-2020-14864 before patching?

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or implement path traversal blocking rules on Web Application Firewalls (WAF) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION