CVE-2020-2950 CVE-2020-2950

漏洞描述

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

影响产品

oraclebusiness_intelligence查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

www.zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-20-505/↗www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.html↗

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
oracle_business_intelligence_loginRCE Oracle Business Intelligence Default Login business_intelligence	高危	8.3	—	PoCEXP	2023/10/20
CVE-2021-4104RCE CVE-2021-4104 Fedora Weblogic Server jboss_enterprise_application_platform+2	高危	7.5	72.2%	PoCEXP	2021/12/14
CVE-2020-14815 CVE-2020-14815 business_intelligence	高危	8.2	81.9%	PoCEXP	2020/10/21
CVE-2020-14864 Oracle Fusion - Directory Traversal/Local File Inclusion business_intelligence	高危	7.5	94.0%	PoCEXP	2020/10/21
CVE-2019-2616 Oracle Business Intelligence/XML Publisher - XML External Entity Injection business_intelligence	高危	7.2	94.3%	PoCEXP	2019/04/23
CVE-2019-2588 Oracle Business Intelligence - Path Traversal business_intelligence	中危	4.9	81.3%	PoCEXP	2019/04/23

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞