Oracle Default Accounts

critical Nessus Plugin ID 22075

Language:

Synopsis

One or more default accounts have been found in the remote database.

Description

The remote Oracle database server has one or more default accounts, possibly from older versions of Oracle or third-party software that uses Oracle.

An attacker may use these accounts to gain access to the database and read or possibly even modify it.

Solution

If using a third-party product, contact the vendor for an update.

Otherwise, either disable the reported accounts or change the associated passwords.

Plugin Details

Severity: Critical

ID: 22075

File Name: oracle_default_account.nbin

Version: 1.283

Type: remote

Family: Databases

Published: 7/19/2006

Updated: 11/22/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score was rationalized for default db credentials.

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: manual

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:oracle:database_server

Required KB Items: Oracle/TestDefaultAccounts

Detections

Analytics