CVE-2007-5508
CVSS V2 Medium 6.5
CVSS V3 None
Description
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GIST, (3) TOKENS, (4) FILTER, (5) HIGHLIGHT, and (6) MARKUP procedures, aka DB03. NOTE: remote unauthenticated attack vectors exist when CTXSYS is used with oracle Application Server.
Overview
- CVE ID
- CVE-2007-5508
- Assigner
- cve@mitre.org
- Vulnerability Status
- Modified
- Published Version
- 2007-10-17T23:17:00
- Last Modified Date
- 2018-10-15T21:45:31
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.5
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 6.4
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2007-5508 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5508 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 18:20:00 | Added to TrackCVE |