CVE-2019-2616

🗓️ 23 Apr 2019 18:16:41Reported by oracleType

cve🔗 web.nvd.nist.gov👁 1084 Views🌐 WEB

Vulnerability in Oracle BI Publisher componen

Reporter	Title	Published	Views	Family All 21
zdt	Oracle Business Intelligence / XML Publisher 12.2.1.4.0 - XML External Entity Injection Exploit	19 Apr 201900:00	–	zdt
ATTACKERKB	CVE-2019-2616	23 Apr 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the BI Publisher Security sub-component of the BI Publisher reporting tool (formerly XML Publisher) allows a malicious individual to gain access to modify, add, or delete data.	25 Apr 201900:00	–	bdu_fstec
Circl	CVE-2019-2616	19 Apr 201900:00	–	circl
CISA KEV Catalog	Oracle BI Publisher Unauthorized Access Vulnerability	25 Mar 202200:00	–	cisa_kev
CNVD	Oracle BI Publisher Access Control Error Vulnerability (CNVD-2019-29186)	17 Apr 201900:00	–	cnvd
Check Point Advisories	Oracle Business Intelligence / XML Publisher XML External Entity Injection (CVE-2019-2616)	23 Apr 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-2616	23 Apr 201918:16	–	cvelist
Exploit DB	Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection	19 Apr 201900:00	–	exploitdb
exploitpack	Oracle Business Intelligence XML Publisher 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - XML External Entity Injection	19 Apr 201900:00	–	exploitpack

NVD

Vulners

Node

oracle business_intelligence_publisherMatch11.1.1.9.0

oracle business_intelligence_publisherMatch12.2.1.3.0

oracle business_intelligence_publisherMatch12.2.1.4.0

[
  {
    "product": "BI Publisher (formerly XML Publisher)",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "11.1.1.9.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.3.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.4.0"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
XML payload	request body	xmlpserver/ReportTemplateService.xls	XXE vulnerability in Oracle BI Publisher/XML Publisher allowing unauthenticated access via crafted XML in the request body (P0C shown in PoC).

17 Jun 2026 02:34Current

6Medium risk

Vulners AI Score6

CVSS 26.4

CVSS 3.17.2

EPSS0.92183

SSVC

In Wild

oracle bi publisher xml publisher vulnerability cve-2019-2616 oracle fusion middleware security network access http cvss 3.0 unauthorized access nvd