vulnwire
6.5med

CVE-2004-1338

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLR…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions.

Exploit prediction (EPSS)

1.19% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
Technology feeds
Oracle Database (RSS, critical only)

References

  • marc.info /?l=bugtraq&m=110382230614420&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • ngssoftware.com /advisories/oracle23122004I.txt · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/18655 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.