PT-2008-3343 · Oracle · Oracle Application Express

Published 2008-04-16 · Updated 2018-10-11 · CVE-2008-1811

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Application Express version 3.0.1

Description The issue is related to insufficient authorization checks for SQL commands in the run ddl function in flows 030000.wwv execute immediate, allowing privilege escalation by certain non-DBA remote authenticated users. This can be exploited through remote authenticated attack vectors.

Recommendations For Oracle Application Express version 3.0.1, consider restricting access to the flows 030000.wwv execute immediate function until a patch is available, and ensure that authorization checks are properly implemented for SQL commands in the run ddl function to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-1811

Affected Products

Oracle Application Express

References · 11

• http://securityfocus.com/archive/1/491024/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1811 · Security Note
• http://vupen.com/english/advisories/2008/1233/references · Vendor Advisory
• http://secunia.com/advisories/29829 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1267/references · Vendor Advisory
• http://secunia.com/advisories/29874 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=690 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41858 · Note
• http://securitytracker.com/id?1019855 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2008-082075.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41988 · Note