CVE-2020-14585: 
Oracle Analytics Publisher vulnerability analysis and mitigation

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Mobile Service) affects versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle BI Publisher. The vulnerability requires human interaction from a person other than the attacker and while it exists in Oracle BI Publisher, attacks may significantly impact additional products (NVD, Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 8.2 (Confidentiality and Integrity impacts) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. The scoring indicates that the vulnerability is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires user interaction (UI:R), has changed scope (S:C), and can result in high confidentiality impact (C:H) with low integrity impact (I:L) but no availability impact (A:N) (NVD).

Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data, as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data (NVD).

The vulnerability is considered easily exploitable and requires network access via HTTP. However, successful exploitation requires human interaction from a person other than the attacker (Oracle Advisory).

Oracle has released security patches to address this vulnerability. Customers are strongly advised to apply the Critical Patch Update fixes as soon as possible. The fixes are available for versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 (Oracle Advisory).