CVE-2019-2616 - Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security)

Back Back to CVE browser

HIGH KEV

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security)

Published Apr 23, 2019 ·Due Apr 15, 2022

7.2

HIGH

CVSS 3.1

EPSS 92.18%

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Affected products

Vendor Oracle Corporation Product BI Publisher (formerly XML Publisher) Default
n/a
- Version
  11.1.1.9.0
  Status
  affected
  Constraints
  -
- Version
  12.2.1.3.0
  Status
  affected
  Constraints
  -
- Version
  12.2.1.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

BI Publisher (formerly XML Publisher)

n/a

Version	Status	Constraints
11.1.1.9.0	affected	-
12.2.1.3.0	affected	-
12.2.1.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
x_refsource_MISCPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2616
government-resourceUS Government Resource

Link	Providers	Tags
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html		x_refsource_MISCPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2616		government-resourceUS Government Resource