PT-2008-3343 · Oracle · Oracle Application Express

Publicado 2008-04-16 · Atualizado 2018-10-11 · CVE-2008-1811

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Application Express version 3.0.1

Description The issue is related to insufficient authorization checks for SQL commands in the run ddl function in flows 030000.wwv execute immediate, allowing privilege escalation by certain non-DBA remote authenticated users. This can be exploited through remote authenticated attack vectors.

Recommendations For Oracle Application Express version 3.0.1, consider restricting access to the flows 030000.wwv execute immediate function until a patch is available, and ensure that authorization checks are properly implemented for SQL commands in the run ddl function to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2008-1811

Produtos afetados

Oracle Application Express

Referências · 11

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=690 · Nota
• http://securityfocus.com/archive/1/491024/100/0/threaded · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41858 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1811 · Nota de Segurança
• http://securitytracker.com/id?1019855 · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2008-082075.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41988 · Nota
• http://vupen.com/english/advisories/2008/1233/references · Aviso do Fabricante
• http://secunia.com/advisories/29829 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1267/references · Aviso do Fabricante
• http://secunia.com/advisories/29874 · Aviso do Fabricante