Alberto Bruscino

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 7.0.0.0.0 through 7.6.0.0.0 Oracle BI Publisher version 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the Layout Templates component of Oracle BI Publisher. This can be exploited by a remote attacker to gain read, modify, or delete access to data. Successful attacks can result in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, as well as unauthorized update, insert, or delete access to some data. It may also lead to a partial denial of service. **Recommendations** For Oracle BI Publisher versions 7.0.0.0.0 through 7.6.0.0.0, update to a version that includes the fix for this issue. For Oracle BI Publisher version 12.2.1.4.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Layout Templates component until a patch is available.