Login Request a demo
Unscored severity · published Jul 26, 2005
CVE-2005-2371
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3)…
–
CVSS
22.3%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case it overlaps CVE-2006-0289.
Exploitation
Is it being used?
Exploit prediction (EPSS)22.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Reports · Oracle
6.0; 6i; 9i; 10g · source: NVD
Affected product
RE
Reports
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2371
marc.info
http://marc.info/?l=bugtraq&m=112180096507467&w=2
Vendor Advisory
http://secunia.com/advisories/18493
Vendor Advisory
http://secunia.com/advisories/18608
securitytracker.com
http://securitytracker.com/id?1014524
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
Vendor Advisory
http://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.html
More from Reports
–
CVE-2005-2983
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that…
–
CVE-2005-2378
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat…
–
CVE-2005-2379
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv,…
–
CVE-2002-0947
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary…
–
CVE-2002-1089
rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in…