CVE-2020-14864

Severity

high · on CISA KEV actively exploited

Source

CISA-KEV · kev

Published

2022-01-18

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-14864

⌖ exploited in the wild shame 50/100 exploited-in-wild

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

Players implicated

Oracle · vendor Intelligence Enterprise Edition · product

Description

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

Affected FedRAMP products 10 in the catalog

Product	Provider	Status	Match
Aconex for Defense	Oracle	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM)	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD)	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud	Oracle	Authorized	vendor-exact · 0.90