Detections
Analytics

Oracle Application Server < 10.1.0.0.3 Privilege Escalation

medium Nessus Network Monitor Plugin ID 2881

Synopsis

The remote host is vulnerable to a flaw that allows for the bypassing of authentication.

Description

The remote host is running the Oracle Application Server. This version is reported vulnerable to a privilege escalation flaw. Specifically, users with the 'create job' privileges can obtain administrative access to the database. An attacker exploiting this flaw would need a valid account that had the ability to create new database jobs. Successful exploitation would result in the attacker being able to read or write confidential data.

Solution

Upgrade to version 10.1.0.0.3 or higher.

Plugin Details

Severity: Medium

ID: 2881

Family: Web Servers

Published: 5/5/2005

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:oracle:application_server

Reference Information

CVE: CVE-2005-1496

BID: 13509