Oracle · BI Publisher (Formerly XML Publisher)

CVE-2019-2616

Oracle BI Publisher Unauthorized Access Vulnerability

Exploited in attacks High 7.2 Attack chance: 92%

What it is

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

CISA: Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: April 23, 2019
Severity: High 7.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 92% in the top 0.2% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (1)

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

More exploited flaws from Oracle

Added	Vulnerability	Product	Severity	Attack chance
Aug 24, 2026	Improper Access ControlCVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Critical 10.0	73%
Jul 15, 2026	Improper Privilege ManagementCVE-2026-46817	E-Business Suite	Critical 9.8	12%
Jun 12, 2026	PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionCVE-2026-35273used by ransomware	PeopleSoft Enterprise PeopleTools	Critical 9.8	97%
Jun 1, 2026	UnspecifiedCVE-2024-21182	WebLogic Server	High 7.5	74%
Nov 21, 2025	Missing Authentication for Critical FunctionCVE-2025-61757	Fusion Middleware	Critical 9.8	89%
Oct 20, 2025	Server-Side Request Forgery (SSRF)CVE-2025-61884used by ransomware	E-Business Suite	High 7.5	96%
Oct 6, 2025	UnspecifiedCVE-2025-61882used by ransomware	E-Business Suite	Critical 9.8	99.7%
Feb 24, 2025	DeserializationCVE-2024-20953	Agile Product Lifecycle Management (PLM)	High 8.8	3.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.