WaratekVRT Sign in

CVE-2019-2588

Affected versions11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
Severity4.9 Medium CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update April 2019
Published23 Apr 2019
Updated17 Jun 2026

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · honeypot sightings · earliest 2024-01-22.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Nuclei; first seen 2019-04-19.
  • EPSS 37% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-2588 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 230 days 2024-01-22 to 2026-11-10
Reported exploitation f5.com /labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024 2024-09-19
Reported exploitation f5.com /labs/articles/threat-intelligence/botpoke-scanner-switches-ip 2024-11-25
Reported exploitation f5.com /labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389 2025-01-21
IndexArtifactStarsFirst seen
Exploit-DB Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal 2019-04-19
Nuclei Oracle Business Intelligence - Path Traversal

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by An indexed exploit clearing the evidence bar to reverse-engineer, where there is no source to read
Finding Mitigation candidate: 2 public proof-of-concept exploit(s) are indexed for this CVE (exploit-db, nuclei), but the affected code is not open source. That makes an ARMR patch rule a candidate rather than a plan. The exploit gives a reproducible entry point to trace inward from and a test to validate a hook against, which is what makes reverse engineering tractable at all. No rule exists and none is scheduled: the hook point must be recovered by decompiling the affected code, and a closer look may find none that ARMR can act on.

CVSS

4.9 MEDIUM v3.0 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 4.9 MEDIUM CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Fusion Middleware / BI Publisher Security (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware BI Publisher Security 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle business intelligence publisher generic 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Vendor Advisory

Timeline
Published2019-04-23By the CVE Program.
VulnCheck KEV: earliest evidence2024-01-22Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.