CVE-2020-14204 - CVE House
Back to Database
Status published High CVE-2020-14204

In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows...

Vulnerability Description

In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibi_apps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-14204

Credits & Attribution

No credits recorded in the NVD database.

References

More from ibi

View All →
CVE-2025-11548
ibi WebFOCUS - Unauthenticated RCE Vulnerability
Critical 9.3
CVE-2020-14203
WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery...
High 8.8
CVE-2020-14202
WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via...
Medium 6.1

Affected Vendor

Affected Software

webfocus business intelligence
Vulnerable Versions:
8.0

Timeline

Official Publish: June 22nd, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.