CVE DatabaseCVE-2019-2616

Updated 2026-06-17한국어 권고문 →

CVE-2019-26167.2/HIGHCISA KEV

Oracle Fusion Middleware BI Publisher Security Bypass and Data Modification/Disclosure Vulnerability (CVE-2019-2616) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

bi_publisher, fusion_middleware

Published Date

2019-04-23

CVSS v3.1

7.2

HIGH

EPSS (30d)

92.2%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Fusion Middleware BI Publisher (formerly XML Publisher) versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0

Impact

Unauthenticated remote attackers can read, update, insert, or delete sensitive data via HTTP, potentially impacting connected downstream systems

Mitigation

Apply the official Oracle Critical Patch Update (CPU) immediately and restrict access to BI Publisher endpoints using a WAF or reverse proxy

Affected Products & Version Scope

Oracle Fusion Middleware BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official Oracle Critical Patch Update (CPU) using the OPatch utility. Follow the steps below to apply the patch:

bash

# Set Oracle environment variables
export ORACLE_HOME='/u01/app/oracle/middleware'
export PATH=$ORACLE_HOME/OPatch:$PATH

# Verify patch conflicts before applying
opatch prereq CheckConflictAgainstOHWithDetail -phBaseDir './29252224'

# Apply the patch (requires service downtime)
opatch apply

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, restrict access to the BI Publisher endpoints using a reverse proxy such as Nginx.

nginx

# Nginx configuration to restrict access to BI Publisher endpoints
server {
    listen 80;
    server_name bipublisher.local;

    # Restrict access to sensitive BI Publisher paths to trusted internal IPs only
    location ~* /(xmlpserver/services|xmlpserver/servlet) {
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        deny all;
        proxy_pass http://backend_bi_publisher;
    }
}

3. Log Audit & IoC Verification Commands

Audit the BI Publisher access logs to identify unauthorized access attempts to sensitive servlets returning a 200 OK status.

bash

# Scan access logs for unauthorized successful requests to BI Publisher endpoints
grep -E '/xmlpserver/(services|servlet|report)' /u01/app/oracle/middleware/user_projects/domains/bip_domain/servers/AdminServer/logs/access.log | grep ' 200 ' | awk '{print $1, $4, $7, $9}'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the Oracle April 2019 CPU patch and restrict external network exposure.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-2616) exists in the BI Publisher Security subcomponent of Oracle Fusion Middleware. Due to insufficient input validation and flawed authorization checks, an unauthenticated attacker with network access via HTTP can bypass security controls and gain unauthorized access to the application's internal resources.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending crafted HTTP GET or POST requests to specific vulnerable endpoints or servlets within the BI Publisher application. Because the vulnerability allows a Scope change (S:C), a successful exploit not only compromises the BI Publisher data but can also be leveraged to access or modify resources in other integrated Oracle Fusion Middleware components and databases.

3. Infrastructure & Business Impact

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild, and carries a high EPSS score of over 0.92. Successful exploitation can lead to unauthorized data modification, insertion, or deletion, resulting in critical business report tampering, data leakage, and severe compliance violations.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: secalert_us@oracle.com · Patch, Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2616

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2019-2616)

FAQ

Q1. How critical is CVE-2019-2616 and is it actively exploited in the wild?

CVE-2019-2616 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 92.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2019-2616?

Primary impacted vendors include oracle across bi_publisher, fusion_middleware. Scope summary: Oracle Fusion Middleware BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0

Q3. What temporary mitigations or workarounds exist for CVE-2019-2616 before patching?

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict access to BI Publisher endpoints using a WAF or reverse proxy Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION