| Vulnerability Name: | CVE-2005-2372 (CCN-21435) | ||||||||
| Assigned: | 2005-07-19 | ||||||||
| Published: | 2005-07-19 | ||||||||
| Updated: | 2016-10-18 | ||||||||
| Summary: | Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet. | ||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2005-2372 Source: BUGTRAQ Type: UNKNOWN 20050719 Oracle Security Advisory: Run any OS Command via unauthorized Oracle Forms Source: CCN Type: Oracle Form Service Web page Oracle Forms 10g Source: CCN Type: OSVDB ID: 18116 Oracle Forms f90servlet module Parameter Arbitrary fmx Execution Source: CCN Type: Red-Database-Security Web site Run any OS Command via unauthorized Oracle Forms Source: MISC Type: Exploit, Vendor Advisory http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html Source: CCN Type: BID-14319 Oracle Forms Services Unauthorized Form Execution Vulnerability Source: XF Type: UNKNOWN oracle-forms-command-execution(21435) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||