CVE-2019-2898: Vulnerability in the BI Publisher (formerly XML Publisher) product of Oracle Fusion Middleware (component:...

Security readout for executives and security teams

CVE-2019-2898 is an Oracle BI Publisher confidentiality issue. A low-privileged attacker with HTTP network access could read a subset of BI Publisher data without authorization. The sources do not indicate system takeover, data modification, service disruption, or confirmed active exploitation. Exposure is most likely where affected Oracle BI Publisher versions are reachable over HTTP by low-privileged authenticated users. The bundle does not identify affected deployments beyond the listed versions or configuration details. Prioritize remediation where BI Publisher contains sensitive reporting data or is broadly accessible internally. This is not described as a takeover risk, but unauthorized data exposure can still affect compliance and confidentiality obligations. Mitigation focus: Review Oracle's October 2019 Critical Patch Update guidance for BI Publisher.; Patch or upgrade affected BI Publisher versions according to Oracle's supported instructions.; Restrict BI Publisher HTTP access to required trusted users and networks..

Prepared

Jun 6, 2026, 12:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.