Secuno
ENNL
Book demo

CVE-2019-2616

Oracle BI Publisher Unauthorized Access

7.2 HIGHActively exploited (CISA KEV)EPSS 92.2%
  1. Published23 Apr 2019
  2. Added to CISA KEV25 Mar 2022
  3. Remediation due15 Apr 2022
Actively exploited (CISA KEV)

Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.

Added to KEV: 25 Mar 2022Federal remediation due: 15 Apr 2022

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

Oracle Business Intelligence Publisher11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Frequently asked

Is CVE-2019-2616 being actively exploited?

Yes. CVE-2019-2616 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022.

How severe is CVE-2019-2616?

CVE-2019-2616 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 92.2% probability of exploitation.

Which products are affected by CVE-2019-2616?

Affected products include Oracle Business Intelligence Publisher.

How do I fix CVE-2019-2616?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-2616 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.