CVE-2020-14864

What it actually does

Path traversal flaw in the Installation component allows unauthenticated remote attackers to read arbitrary files on the Oracle BI EE server via specially crafted HTTP requests, resulting in full disclosure of all accessible data.

Why it matters to the business

Attackers can steal sensitive business intelligence reports, dashboards, and underlying data without authentication, leading to loss of confidentiality, regulatory exposure, and potential competitive disadvantage; the flaw remains actively exploited in the wild with a CISA remediation deadline of 2022-07-18.

How an attack unfolds

An attacker discovers an exposed Oracle BI EE instance and sends crafted HTTP requests containing directory traversal sequences to the Installation component, bypassing access controls to retrieve files containing critical data. Threat actors have demonstrated this technique against Oracle Business Intelligence Enterprise Edition.

How to fix it

Apply the latest Oracle Critical Patch Update that resolves CVE-2020-14864 for versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0; restrict network access to BI EE management interfaces and enforce authentication where possible.

How to confirm the fix worked

Confirm the installed Oracle BI EE version is no longer listed as vulnerable in the October 2020 CPU, review access logs for absence of traversal patterns, and perform authenticated file access tests from a non-privileged network location.

Typical attack path

1. Scan for publicly reachable Oracle BI EE instances on ports 7001/9704
2. Send unauthenticated HTTP GET requests containing path traversal payloads to the Installation endpoint
3. Iterate traversal sequences to locate and exfiltrate sensitive configuration, report, and data files
4. Use obtained data for further lateral movement or intelligence gathering

How to detect it

Inspect Oracle BI EE HTTP access logs for requests containing repeated dot-dot-slash sequences or encoded traversal payloads targeting the Installation component; correlate with high-volume unauthenticated traffic from external sources.

• ..%2f
• ..%5c
• %2e%2e%2f
• Installation.*\?\w*=.*\.\./
• GET /.*Installation.*\.\./.* HTTP/1.1

What your security team should do

• Prioritize immediate patching of all KEV-listed Oracle BI EE instances due to active exploitation and high EPSS score
• Block or tightly restrict inbound HTTP access to BI EE ports from untrusted networks
• Enable and centrally collect web access logs for traversal pattern detection
• Conduct an audit of exposed BI EE deployments and reduce public footprint