CVE-2020-14864

Oracle Business Intelligence Enterprise Edition suffered a path traversal vulnerability allowing attackers to read arbitrary system files via the getPreviewImage function.

An attacker could exploit the path traversal flaw in Oracle Business Intelligence Enterprise Edition to access sensitive system files, potentially exposing credentials or configuration data. This unpatched vulnerability was actively exploited in the wild, highlighting the risk of relying on known CVEs without timely remediation. DIB organizations must ensure all Oracle BI EE instances are patched and monitored for exploitation attempts.

Shame score — A known path traversal vulnerability was actively exploited in the wild, indicating negligence in patch management and leaving systems exposed to data exfiltration.