CVE-2020-14864

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion...

7.5 HighIn KEVPublic exploit

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

97.2%Up 94.5 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

Record: CVE-2020-14864
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2020-7000 7.5

Record: EUVD-2020-7000
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p833-99r6-7hqr 7.5

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion...

Record: GHSA-p833-99r6-7hqr
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

Oracle Business Intelligence Enterprise Edition Path Transversal

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

Record: CVE-2020-14864
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.5

Record: CVE-2020-14864
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 7.8 HighAV:N/AC:L/Au:N/C:C/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion	2020-10-28
Nuclei	Oracle Fusion - Directory Traversal/Local File Inclusion

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14864 is a high vulnerability (CVSS 7.5) in Oracle Business Intelligence, published October 21, 2020. CISA lists it as known to be exploited, since January 18, 2022. EUVD reports exploitation since January 18, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.2%, the 99th percentile. No source names a fixed version.