CVE-2019-2616KEV · OVERDUE

Oracle BI Publisher Unauthorized Access Vulnerability

High · published April 23, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1652
days past CISA
deadline
CVSS v3.1
7.2
EPSS
92%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 Just one HTTP request is enough for an unauthenticated attacker to compromise BI Publisher! This vulnerability in Oracle Fusion Middleware is as sneaky as a cat burglar slipping through an unlocked window! 🔥 Think of this vulnerability like a delivery driver accepting packages without checking the name on the order—anyone can send a request and potentially gain access to sensitive data, wreaking havoc in the process! 📦 If an attacker exploits this vulnerability, they could gain unauthorized access to update, insert, or delete information within BI Publisher. This could lead to unauthorized data exposure, and even worse, sensitive information could be tampered with, leaving you scrambling to restore your data integrity!

Put simply

Think of this vulnerability like a delivery driver accepting packages without checking the name on the order—anyone can send a request and potentially gain access to sensitive data, wreaking havoc in the process! 📦 This vulnerability allows unauthenticated attackers with network access to bypass security restrictions in BI Publisher, leading to unauthorized read and write operations on accessible data.

What to do

If an attacker exploits this vulnerability, they could gain unauthorized access to update, insert, or delete information within BI Publisher. This could lead to unauthorized data exposure, and even worse, sensitive information could be tampered with, leaving you scrambling to restore your data integrity! To protect your environment, patch your BI Publisher to the latest supported version immediately. Ensure that you restrict network access to the BI Publisher component to only trusted sources to limit exposure. Regularly audit your data access controls to ensure that only authorized users have the necessary permissions. You've got this! By following these steps, you'll be well on your way to keeping your data secure and maintaining your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.92183 · 99.8th percentile
Published
2019-04-23T18:16Z
KEV added
2022-03-25 · due 2022-04-15
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 23 APR 18:16Z
    Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security)
    cvelistv5