PT-2020-4566 · Oracle · Oracle Bi Publisher

Mateusz Dabrowski · Published 2020-10-21 · Updated 2020-10-26 · CVE-2020-14784

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

Description The issue is related to insufficient input validation in the Mobile Service component of Oracle BI Publisher, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. The impact of the attack can be significant, affecting not only Oracle BI Publisher but also other products.

Recommendations For versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the Mobile Service component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05115

CVE-2020-14784

Affected Products

Oracle Bi Publisher

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-14784 · Security Note
• https://bdu.fstec.ru/vul/2020-05115 · Security Note
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14784 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020102949 · Note