WaratekVRT Sign in

CVE-2019-2767 Oracle BI Publisher

Affected softwareOracle BI Publisher
Affected versions11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
Severity7.2 High CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update July 2019
Published23 Jul 2019
Updated17 Jun 2026

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · earliest 2024-09-19.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in Nuclei.
  • EPSS 5.2% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-2767 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation f5.com /labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024 2024-09-19
Reported exploitation f5.com /labs/articles/threat-intelligence/botpoke-scanner-switches-ip 2024-11-25
Reported exploitation f5.com /labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389 2025-01-21
IndexArtifactStarsFirst seen
Nuclei Oracle Business Intelligence Publisher - XML External Entity Injection

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by An indexed exploit clearing the evidence bar to reverse-engineer, where there is no source to read
Finding Mitigation candidate: 1 public proof-of-concept exploit(s) are indexed for this CVE (nuclei), but the affected code is not open source. That makes an ARMR patch rule a candidate rather than a plan. The exploit gives a reproducible entry point to trace inward from and a test to validate a hook against, which is what makes reverse engineering tractable at all. No rule exists and none is scheduled: the hook point must be recovered by decompiling the affected code, and a closer look may find none that ARMR can act on.

CVSS

7.2 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 6.4 none AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Fusion Middleware / BI Publisher Security (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware BI Publisher Security 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle bi publisher generic 11.1.1.9.0

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Vendor Advisory

Timeline
Published2019-07-23By the CVE Program.
VulnCheck KEV: earliest evidence2024-09-19Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2025-01-21Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.