CVE-2019-2767

HIGHNuclei

BI Publisher Component of Oracle Fusion Middleware Unauthorized Update, Insert or Delete Vulnerability

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-2767 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 15, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

BI Publisher

Browse Oracle / BI Publisher
VulnCheckVersion data not supplied

BI Publisher (formerly XML Publisher)

Browse Oracle Corporation / BI Publisher (formerly XML Publisher)
CVE List11.1.1.9.0affected
12.2.1.3.0affected
12.2.1.4.0affected

Nuclei templates

1
ProjectDiscoveryHIGHOracle Business Intelligence Publisher - XML External Entity InjectionCVSS 7.2

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publisher.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information or disrupt the availability of the system.

Remediation

Apply the latest security patches provided by Oracle to fix this vulnerability.

Authorsmadrobot
Template tagscvecve2019edboraclexxeoastvkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:oracle:bi_publisher:11.1.1.9.0:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/46729 http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://nvd.nist.gov/vuln/detail/CVE-2019-2767 https://github.com/ARPSyndicate/kenzer-templates https://github.com/vah13/Oracle-BI-bugs

Source: ProjectDiscovery

References

2