{"id":"CVE-2019-2616","kind":"vulnerability","aliases":["CVE-2019-2616"],"related":[],"title":"Oracle BI Publisher (Formerly XML Publisher): Oracle BI Publisher Unauthorized Access Vulnerability","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","summary":"Oracle BI Publisher (formerly XML Publisher) has an unspecified flaw that allows unauthorized actions, reported as an authentication bypass. CISA lists it as actively exploited in the wild, so an attacker can likely act on the server without valid credentials.","severity":"high","cvss":7.2,"epss":0.92183,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Oracle BI Publisher (Formerly XML Publisher)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise","exploited","oracle-bi-publisher","self-hosted","vendor"],"not_affected_if":["not-deployed"],"how_to_check":"Identify whether Oracle BI Publisher is deployed and which patch level it runs; the sources do not give a version check command.","fix":"Apply the Oracle security updates per vendor instructions, as CISA requires; the sources do not name the fixed version.","status":"open","published_at":"2019-04-23T19:32:51+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:02+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:20:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security updates per vendor instructions, as CISA requires; the sources do not name the fixed version.\nunknown","reach":"network","impact":"high","summary":"Oracle BI Publisher (formerly XML Publisher) has an unspecified flaw that allows unauthorized actions, reported as an authentication bypass. CISA lists it as actively exploited in the wild, so an attacker can likely act on the server without valid credentials.","category":"vendor","who_cares":["oracle-bi-publisher","enterprise","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker bypasses authentication and performs unauthorized actions on the reporting server","analyst_note":"Find the fixed version and detection guidance in Oracle's July 2019 Critical Patch Update advisory and the CISA KEV entry; confirm the exact affected releases.","how_to_check":"Identify whether Oracle BI Publisher is deployed and which patch level it runs; the sources do not give a version check command.\nunknown","needs_analyst":true,"not_affected_if":["not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2881,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':14A,17A '-2616':15A,18A '/av':190C '11.1.1.9.0':98C '12.2.1.3.0':99C '12.2.1.4.0':101C '3.0':178C,189C '7.2':181C 'access':11A,110C,149C,158C,165C,175C 'act':68B 'action':48B 'activ':58B 'addit':134C 'affect':96C 'allow':46B,105C 'attack':65B,107C,130C,137C 'authent':52B 'base':179C 'bi':2A,8A,20A,29B,36B,78C,89C,115C,125C,153C,170C 'bypass':53B 'c/c':195C 'cisa':54B 'compon':83C 'compromis':114C 'confidenti':182C 'credenti':74B 'cve':13A,16A 'cvss':177C,186C,188C 'data':159C,176C 'delet':148C 'easili':102C 'enterpris':25B 'exploit':26B,59B,103C 'flaw':44B 'former':4A,38B,80C,117C,127C,155C,172C 'formerly':22A 'fusion':86C 'host':33B 'http':112C 'impact':133C,185C 'insert':146C 'integr':184C 'l/a':197C 'l/i':196C 'l/pr':192C 'like':67B 'list':55B 'may':131C 'middlewar':87C 'n':198C 'n/ac':191C 'n/s':194C 'n/ui':193C 'network':109C 'oracl':1A,7A,28B,35B,85C 'oracle':19A 'oracle-bi-publish':27B 'product':135C 'publish':3A,6A,9A,30B,37B,40B,79C,82C,90C,116C,119C,126C,129C,154C,157C,171C,174C 'publisher':21A,24A 'read':164C 'report':49B 'result':142C 'score':180C 'secur':91C 'self':32B 'self-host':31B 'server':71B 'signific':132C 'subcompon':88C 'subset':168C 'success':136C 'support':92C 'unauthent':106C 'unauthor':10A,47B,144C,163C 'unspecifi':43B 'updat':145C 'valid':73B 'vector':187C 'vendor':34B 'version':93C 'via':111C 'vulner':12A,75C,104C,122C,140C 'well':161C 'wild':62B 'without':72B 'xml':5A,23A,39B,81C,118C,128C,156C,173C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-04-23T19:32:51+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-2616","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2616","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2019-2616","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-2616","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-2616","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2616","severity":null,"published_at":"2019-04-23T19:32:51+00:00","modified_at":"2026-06-17T02:34:13+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}