CVE-2021-2400

What it actually does

This is an unauthenticated, network-accessible information disclosure vulnerability affecting Oracle BI Publisher in Oracle Fusion Middleware, specifically the E-Business Suite XDO component. An attacker who can reach the BI Publisher HTTP interface can trigger vulnerable functionality without credentials or user interaction and read critical data exposed through BI Publisher-accessible data sources, reports, templates, or metadata. The CVSS vector indicates high confidentiality impact only: the flaw is not described as enabling code execution, data modification, or service disruption, but successful exploitation may expose all data reachable by the BI Publisher application context.

Why it matters to the business

The primary risk is unauthorized disclosure of sensitive business data, such as reports, financial records, operational data, employee information, customer information, or other content made available through BI Publisher. Because exploitation requires only network access over HTTP and no authentication, internet-facing or broadly reachable deployments carry elevated risk. The EPSS score is high, which suggests meaningful exploitation likelihood even though the vulnerability is not currently listed in CISA KEV and no ransomware association is provided. The vulnerability is old and should be treated as overdue technical debt in any still-unpatched Oracle BI Publisher deployment. Note: the supplied affected-product metadata references fastify/fastify-static and a Git commit fix, which conflicts with the Oracle BI Publisher description; organizations should reconcile SBOM/package findings against actual Oracle BI Publisher exposure before closing risk.

How an attack unfolds

An attacker first identifies an exposed Oracle BI Publisher or E-Business Suite XDO HTTP endpoint, commonly by service fingerprinting, web crawling, or searching for BI Publisher login and servlet paths. Because the vulnerability is unauthenticated and low-complexity, the attacker does not need valid credentials or to convince a user to perform an action. The attacker sends crafted HTTP requests to vulnerable BI Publisher functionality and abuses improper access control or data exposure behavior to retrieve protected report content, metadata, or data accessible to the BI Publisher application. The attacker may then enumerate additional reports, parameters, templates, data models, or downloadable outputs to expand the scope of exposed information. If sensitive credentials, tokens, business records, or report exports are disclosed, the attacker may use that information for fraud, espionage, lateral movement, or targeted follow-on attacks.

How to fix it

Apply the relevant Oracle Critical Patch Update that fixes CVE-2021-2400 for Oracle BI Publisher / Oracle Fusion Middleware / E-Business Suite XDO. Affected Oracle BI Publisher versions listed are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. Prioritize systems reachable from the internet, partner networks, VPN users, or large internal user populations. If immediate patching is not possible, restrict access to BI Publisher endpoints using network allowlists, reverse proxy rules, WAF controls, VPN-only access, and strong authentication gates in front of the application. Review BI Publisher data source privileges so the BI Publisher application account can access only required data. Disable unused reports, public report folders, sample applications, and unnecessary XDO/BI Publisher endpoints. Because the supplied package metadata also references fastify/fastify-static fixed in commit d97b2cf6a0353e784ad2674aaecd6508ac74130d, verify whether any SBOM finding is actually for that package; if so, update that dependency to a version containing commit d97b2cf6a0353e784ad2674aaecd6508ac74130d or later, but do not treat that as remediation for Oracle BI Publisher unless the asset is truly a Fastify static-file application.

How to confirm the fix worked

Confirm the deployed Oracle BI Publisher, Oracle Fusion Middleware, or E-Business Suite version is no longer one of the affected versions and that the applicable Oracle CPU patch is installed. Validate through vendor patch inventory, OPatch output, application version pages where available, and configuration management records. From an unauthenticated network position, verify that BI Publisher/XDO endpoints do not expose report data, metadata, templates, or downloadable content and instead return authentication or authorization failures. Review reverse proxy and firewall policy to ensure BI Publisher is not exposed beyond intended networks. If a scanner is used, prefer authenticated version/patch checks over banner-only detection. For package-management findings referencing fastify/fastify-static, verify the installed dependency includes commit d97b2cf6a0353e784ad2674aaecd6508ac74130d or a later fixed release, and separately confirm whether the finding is unrelated to the Oracle BI Publisher vulnerability.

Typical attack path

1. Discover a reachable Oracle BI Publisher, Oracle Fusion Middleware, or E-Business Suite XDO web interface over HTTP or HTTPS.
2. Fingerprint the application version or identify BI Publisher-specific paths, headers, pages, or responses.
3. Send unauthenticated HTTP requests to vulnerable BI Publisher/XDO functionality.
4. Retrieve report output, metadata, templates, data models, or other BI Publisher-accessible content without authorization.
5. Enumerate additional accessible objects and repeat requests to collect sensitive data at scale.
6. Use disclosed data for business intelligence theft, credential discovery, fraud, extortion leverage, or follow-on compromise.

How to detect it

To determine whether exploitation already occurred, review web server, reverse proxy, load balancer, WAF, Oracle HTTP Server, WebLogic, and BI Publisher application logs for unauthenticated requests to BI Publisher or XDO paths. Focus on HTTP 200 responses, large response sizes, repeated report downloads, requests with no authenticated session cookie, unusual query parameters, and sequential enumeration of report, template, data model, or servlet endpoints. Compare source IPs against expected user locations, VPN egress ranges, partner networks, and known scanners. Investigate spikes in GET or POST requests to BI Publisher immediately before or after sensitive report downloads. Review BI Publisher audit logs, if enabled, for anonymous or unexpected report execution, catalog browsing, template access, data model access, or export activity. Examine WAF logs for path traversal, parameter tampering, forced browsing, or access-control bypass attempts involving BI Publisher paths. If sensitive data was accessible, correlate exposed report names and timestamps with downstream activity such as suspicious logins, credential misuse, fraud attempts, or unusual database access. For Fastify/static-file findings, separately review application access logs for suspicious static file requests, traversal-like path patterns, and requests for server-side configuration or source files.

• /xmlpserver
• /xmlpserver/servlet
• /xmlpserver/services
• /xmlpserver/Guest
• /xmlpserver/Report
• /xmlpserver/ReportService
• /xmlpserver/ReportTemplateService
• /xmlpserver/ScheduleService
• /xmlpserver/PublicReportService
• /analytics
• /OA_HTML
• /OA_HTML/RF.jsp
• /OA_HTML/OA.jsp
• /xdo
• XDO
• BI Publisher
• Oracle BI Publisher
• GET /xmlpserver
• POST /xmlpserver
• GET /xmlpserver/servlet
• POST /xmlpserver/servlet
• GET /analytics
• POST /analytics
• 200 /xmlpserver
• 200 /xmlpserver/servlet
• ../
• ..%2f
• %2e%2e%2f
• %252e%252e%252f
• /etc/passwd
• /WEB-INF/web.xml
• /META-INF/MANIFEST.MF
• /package.json

What your security team should do

• Immediately inventory all Oracle BI Publisher, Oracle Fusion Middleware, and E-Business Suite XDO deployments, prioritizing internet-facing and broadly reachable systems.
• Apply the relevant Oracle CPU patch or upgrade path for affected Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0.
• Until patched, restrict BI Publisher access to trusted networks and authenticated access paths; block direct public access where possible.
• Review BI Publisher report folders, data models, templates, and data source permissions for excessive exposure.
• Hunt historical web access logs for unauthenticated access to BI Publisher/XDO endpoints, unusual report downloads, high-volume enumeration, and requests from unfamiliar external IP addresses.
• Reconcile the conflicting product metadata: confirm whether the asset exposure is Oracle BI Publisher or fastify/fastify-static, and remediate the actual deployed product accordingly.
• Because EPSS is high, track remediation as urgent even though the vulnerability is not currently listed in CISA KEV.