VulnerabilityModified

CVE-2005-4832

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2)…

HIGH 7.5EPSS 41.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 41.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 41.67% probability · 99th percentile
CISA KEV: Not listed
Affected: oracle/oracle10g
Source: cve@mitre.org

References

http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlExploit, Vendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txtExploit, Vendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlExploit, Vendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdfPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/396133Exploit, Vendor Advisory
http://www.securityfocus.com/archive/1/404970Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13236
https://exchange.xforce.ibmcloud.com/vulnerabilities/20159
http://www.appsecinc.com/resources/alerts/oracle/2005-02.htmlExploit, Vendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txtExploit, Vendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sqlExploit, Vendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdfPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/396133Exploit, Vendor Advisory
http://www.securityfocus.com/archive/1/404970Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13236
https://exchange.xforce.ibmcloud.com/vulnerabilities/20159

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.