CVE-2019-2616

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is an easily exploitable flaw in the BI Publisher Security subcomponent of Oracle BI Publisher (formerly XML Publisher) within Oracle Fusion Middleware. It affects supported versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. The issue permits unauthorized access that can affect data confidentiality and integrity, with a CVSS 3.0 base score of 7.2 reflecting network-accessible attack vectors without authentication.

An unauthenticated attacker with network access via HTTP can exploit the flaw to compromise BI Publisher and potentially impact additional Oracle products. Successful exploitation grants the ability to perform unauthorized updates, inserts, or deletions on some accessible data, along with read access to a subset of that data, without requiring user interaction.

The referenced Oracle Critical Patch Update for April 2019 addresses the issue through available patches for the affected Fusion Middleware versions. The vulnerability also appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed real-world exploitation activity.