Remote File Access and HTTP Request Forgery in WebFOCUS Business Intelligence
CVE-2020-14204

8.2HIGH

Key Information:

Vendor

Ibi

Status
Webfocus Business Intelligence
Vendor
CVE Published:
22 June 2020

What is CVE-2020-14204?

A vulnerability exists in WebFOCUS Business Intelligence that allows remote attackers to read local files or forge server-side HTTP requests through specially crafted HTTP requests targeting the administration portal. This security issue arises due to the improper handling of XML external entities within the application repository configuration, which could lead to unauthorized access and manipulation of the server's functionality.

References

https://www.hooperlabs.xyz/disclosures/webfocus.php
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.