CVE-2020-14204: XEE
In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibiapps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-14204?
CVE-2020-14204 is considered to have a medium severity level due to its potential for unauthorized file access and server-side request forgery.
How do I fix CVE-2020-14204?
To fix CVE-2020-14204, it is recommended to upgrade to the latest version of WebFOCUS Business Intelligence that does not contain this vulnerability.
What types of attacks are possible with CVE-2020-14204?
CVE-2020-14204 allows attackers to perform XML external entity injection, leading to unauthorized file reading and server-side HTTP request forgery.
Which version of WebFOCUS is affected by CVE-2020-14204?
CVE-2020-14204 specifically affects WebFOCUS Business Intelligence version 8.0 service pack 6.
Is there a patch available for CVE-2020-14204?
Yes, a patch is typically included in the upgrade to a newer version of WebFOCUS that addresses the vulnerabilities listed in CVE-2020-14204.