CVE-2019-2588

MEDIUM EXPLOITED NUCLEI

Oracle Fusion Middleware - Unauthorized Access

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-2588 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Vahagn Vardanyan. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Oracle Business Intelligence, allowing an attacker to read arbitrary files on the server by manipulating the 'documentId' parameter with relative path sequences.

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Vahagn Vardanyan · textwebappswindows
https://www.exploit-db.com/exploits/46728

This exploit demonstrates a directory traversal vulnerability in Oracle Business Intelligence, allowing an attacker to read arbitrary files on the server by manipulating the 'documentId' parameter with relative path sequences.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Oracle Business Intelligence 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
No auth needed
Prerequisites: Network access to the target server · Oracle Business Intelligence server running a vulnerable version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Oracle Business Intelligence - Path Traversal
MEDIUMby madrobot

References (1)

Core 1
Core References

Scores

CVSS v3 4.9
EPSS 0.3710
EPSS Percentile 98.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2024-01-22
Status published
Products (3)
oracle/business_intelligence_publisher 11.1.1.9.0
oracle/business_intelligence_publisher 12.2.1.3.0
oracle/business_intelligence_publisher 12.2.1.4.0
Published Apr 23, 2019
Tracked Since Feb 18, 2026