CVE-2020-14864

Oracle Business Intelligence Enterprise Edition (OBIEE) contains a path traversal flaw (CWE-22) in its Installation component, affecting versions 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access over HTTP can send crafted requests containing directory traversal sequences to reach files or data outside the intended path. Successful exploitation results in unauthorized access to critical data, potentially all OBIEE-accessible data, with confidentiality-only impact per the CVSS vector (C:H/I:N/A:N). The vulnerability is easily exploitable and requires no privileges or user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-18, confirming exploitation in the wild, and EPSS assigns a 97.2% probability of exploitation within 30 days, although no public proof-of-concept is known.

What to do: Apply Oracle's October 2020 Critical Patch Update (or a later CPU) for OBIEE 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0, as required by the CISA KEV catalog action. Until patched, restrict HTTP access to OBIEE servers to trusted networks and review access logs for directory traversal patterns. Because exploitation is confirmed in the wild, prioritize internet-exposed BI instances and verify no unauthorized data access has occurred.