CVE-2019-2588: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that…

PriorityP274medium4.9CVSS 3.0

AVNACLPRHUINSUCHINAN

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

37.10%

98.3th percentile

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
oracle	business_intelligence_publisher	—	—
oracle	business_intelligence_publisher	—	—
oracle	business_intelligence_publisher	—	—
oracle_corporation	bi_publisher	—	—
oracle_corporation	bi_publisher	—	—
oracle_corporation	bi_publisher	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini

→A successful exploitation response on Windows will contain the string 'for 16-bit app support' in the HTTP 200 response body, indicating win.ini was read.
→The format parameter in the exploit is padded with a long string of 'a' characters (aaaaaaaaaaaaaaa); this pattern combined with a traversal documentId value is a strong indicator of CVE-2019-2588 exploitation.

·The traversal payload uses Windows-style backslash separators; the vulnerability was tested on Windows. Linux-based deployments may require forward-slash traversal variants and different target file paths. ↗
·Exploitation requires a high-privileged attacker (PR:H), meaning the attacker must already have authenticated administrative access over HTTP. ↗

CVSS provenance

nvdv3.04.9MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

vulncheck4.9MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.