Oracle BI Publisher XML Services Vulnerability Allowing Unauthorized Data Modification and Partial Denial-of-Service

A vulnerability exists in Oracle BI Publisher, part of Oracle Analytics, specifically within the XML Services component. This issue affects versions 7.6.0.0.0 and 12.2.1.4.0. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Exploitation of this vulnerability could lead to unauthorized modifications, additions, or deletions of certain data accessible within Oracle BI Publisher, as well as the unauthorized ability to cause a partial denial-of-service on the application.

Impact

Exploitation of this vulnerability could result in unauthorized data modifications, including updates, inserts, or deletions, of certain Oracle BI Publisher accessible data. Additionally, it could cause a partial denial-of-service on Oracle BI Publisher.