CVE-2020-14864

What is Oracle BI Enterprise Edition?

Oracle Business Intelligence Enterprise Edition (OBIEE) is Oracle's enterprise reporting and analytics platform, used by organizations to build dashboards and reports over business data warehouses. Because BI platforms aggregate and expose data from across an organization's systems, a file-read vulnerability in one can expose far more than the BI application's own files — depending on filesystem permissions, an attacker may reach configuration files containing database credentials for every data source the BI platform connects to.

Overview

CVE-2020-14864 is a path traversal vulnerability (CWE-22) in OBIEE's getPreviewImage function. The function's FilePath parameter, meant to reference a preview image file for report/dashboard rendering, does not adequately restrict the path an attacker can supply, allowing an unauthenticated remote attacker to read arbitrary files on the server's filesystem (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High).

Technical Details

By manipulating the FilePath parameter with directory-traversal sequences (e.g., ../ chains), an attacker can direct getPreviewImage to read and return the contents of files outside the intended preview-image directory — any file the OBIEE service account has permission to read is potentially exposed, without any authentication required.

Discovery

Patched as part of Oracle's routine October 2020 Critical Patch Update.

Exploitation Context

CISA added this CVE to KEV in January 2022 based on confirmed exploitation. Path traversal bugs in unauthenticated endpoints of enterprise business applications are attractive to attackers primarily for credential harvesting — reading configuration files that reveal database connection strings, API keys, or other secrets that enable further lateral movement into connected systems.

Remediation

1. Apply Oracle's October 2020 Critical Patch Update for OBIEE immediately.
2. Restrict network access to the OBIEE web application to trusted internal networks; BI reporting platforms should rarely, if ever, need to be directly internet-facing.
3. Audit configuration files readable by the OBIEE service account for embedded credentials, and rotate any that may have been exposed if the instance was unpatched and internet-facing.
4. Review OBIEE access logs for requests to getPreviewImage containing directory-traversal sequences, particularly around and after the October 2020 disclosure.