WaratekVRT Sign in

CVE-2019-2768 Oracle BI Publisher

Affected softwareOracle BI Publisher
Affected versions11.1.1.9.0
Severity7.5 High CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update July 2019
Published23 Jul 2019
Updated17 Jun 2026

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. Honeypot sightings · earliest 2024-01-22.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.7% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-2768 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 328 days 2024-01-22 to 2026-11-10

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection unknown
  • Action not assessed
  • Review automated Upstream data
  • Record active
Decided by Somebody exploiting this CVE (a CISA or VulnCheck KEV listing, or a CISA verdict of active exploitation), with no fix, source code or PoC to build a rule from
Finding VulnCheck KEV reports exploitation (seen by Shadowserver honeypots on 328 day(s) from 2024-01-22 to 2026-11-10). VRT found no upstream fix and no open-source Maven package, and no PoC is published, so there is nothing to build an ARMR rule from yet. No rule exists and none is planned. Nobody has checked whether an existing ARMR rule already blocks it.

CVSS

7.5 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Fusion Middleware / BI Publisher Security (11.1.1.9.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware BI Publisher Security 11.1.1.9.0 11.1.1.9.0

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle bi publisher generic 11.1.1.9.0

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Vendor Advisory

Timeline
Published2019-07-23By the CVE Program.
VulnCheck KEV: earliest evidence2024-01-22Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.