CVE-2020-14780: 
Oracle Analytics Publisher vulnerability analysis and mitigation

A vulnerability was identified in the BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). The affected versions include 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. This vulnerability was disclosed in October 2020 and assigned identifier CVE-2020-14780 (Oracle Advisory).

The vulnerability is classified as easily exploitable and allows unauthenticated attackers with network access via HTTP to compromise BI Publisher. The attack requires human interaction from a person other than the attacker. The vulnerability has been assigned a CVSS 3.1 Base Score of 7.1 (High) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data. Additionally, it can lead to unauthorized update, insert or delete access to some of BI Publisher accessible data (Oracle Advisory).

The vulnerability is considered easily exploitable but requires human interaction from someone other than the attacker. The attack vector is through network access via HTTP, and no authentication is required for exploitation (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the October 2020 Critical Patch Update. Affected customers should apply the security patches to the vulnerable versions (5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0) as soon as possible (Oracle Advisory).