PT-2004-3011 · Oracle · Oracle Http Server

Rafel Ivgi + 1 · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2115

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server version 1.3.22

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary scripts as other users. The exploitation is possible via the action, username, or password parameters in an isqlplus request.

Recommendations For Oracle HTTP Server version 1.3.22, update to a version that includes the fix for this issue to prevent exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-2115

Affected Products

Oracle Http Server

References · 6

• 🔥 http://securityfocus.com/bid/9484 · Exploit
• 🔥 https://exploit-db.com/exploits/23593 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2115 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2115 · Note
• http://marc.info/?l=bugtraq&m=107496560106967&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14930 · Note