VulnerabilityModified
CVE-2004-2115
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
MEDIUM 6.8EPSS 58.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 58.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 58.35% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- oracle/http server
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=107496560106967&w=2
- http://www.securityfocus.com/bid/9484Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/14930
- http://marc.info/?l=bugtraq&m=107496560106967&w=2
- http://www.securityfocus.com/bid/9484Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/14930
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.