VulnerabilityModified
CVE-2005-3203
The manual installation of Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges.
MEDIUM 4.6EPSS 0.57%
Does this matter?
Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.
Description
The manual installation of Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges.
- CVSS 2.0
- 4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 0.57% probability · 45th percentile
- CISA KEV
- Not listed
- Affected
- oracle/html db
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html
- http://marc.info/?l=bugtraq&m=112870441917345&w=2
- http://secunia.com/advisories/14935/Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.htmlVendor Advisory
- http://www.securityfocus.com/bid/15033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22542
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html
- http://marc.info/?l=bugtraq&m=112870441917345&w=2
- http://secunia.com/advisories/14935/Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.htmlVendor Advisory
- http://www.securityfocus.com/bid/15033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22542
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.