The Virsec Security Research Lab provides detailed analysis on recent and notable security vulnerabilities.
A Local File Inclusion vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
A Directory Traversal vulnerability has been discovered in the 'getPreviewImage' function of Oracle Business Intelligence Enterprise Edition. The 'getPreviewImage' function is used to get a preview image of a previously uploaded theme logo. By manipulating the 'previewFilePath' URL parameter an attacker with access to the administration interface can read arbitrary system files.
Watch the video to learn more about this and other important vulnerabilities.
The CVSS Base Score is 7.5 (High)
Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0.
This issue was reported publicly by Ivo Palazzolo.
Oracle Business Intelligence (BI) is a portfolio of technology and applications that provides Enterprise Performance Management System, including BI foundation and tools - integrated array of query, reporting, analysis, alerting, mobile analytics, data integration and management, etc.
Oracle BI is one of part of Oracle Fusion Middleware which has a good market share of around 9% as per this link. Any exploit of this vulnerabilities could lead to exposure of all sensitive data that resides on the server, which could lead to leakage of proprietary information. Publicly available exploit of this vulnerability is available.
The Virsec security platform (VSP)-Web capability can detect such a LFI attack and prevent this attack from being exploited.
Download the full vulnerability report to learn more about this and other important vulnerabilities.
Jump to: List of CVE Vulnerabilities