Cyber Resilience

CVE-2020-2950

Oracle Business Intelligence 11.1.1.9.0 … 5.5.0.0.0

High EPSS
Published
15 April 2020
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.71 99.3th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2020-2950 is a critical-severity an unspecified weakness vulnerability in Oracle Business Intelligence. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…

more

compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated network HTTP access leads to full compromise of the exposed BI web application.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-20913Same product: Oracle Business Intelligence
CVE-2024-21001Same product: Oracle Business Intelligence
CVE-2025-30759Same product: Oracle Business Intelligence
CVE-2023-22109Same product: Oracle Business Intelligence
CVE-2023-21910Same product: Oracle Business Intelligence
CVE-2023-22011Same product: Oracle Business Intelligence
CVE-2023-22061Same product: Oracle Business Intelligence
CVE-2023-21891Same product: Oracle Business Intelligence
CVE-2023-21952Same product: Oracle Business Intelligence
CVE-2023-22082Same product: Oracle Business Intelligence

Affected Assets

oracle
business intelligence
11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0, 5.5.0.0.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References