peter bassill · operator
$ cve CVE-2004-1364 JSON

CVE-2004-1364 EXPLOIT

8.5
HIGH · CVSS 2.0 · EPSS 13.9% (pctl 96)

Patch early

A public exploit exists.

Description

Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.

Scoring

CVSS8.5 (HIGH, v2.0)
VectorAV:N/AC:M/Au:S/C:C/I:C/A:C
EPSS13.89% — more likely to be exploited than 96% of all CVEs
WeaknessCWE-22
On CISA KEVno
Public exploityes
Published2004-08-04
Last modified2026-06-16

Affected (9)

VendorProduct
oracleapplication server
oraclecollaboration suite
oraclee-business suite
oracleenterprise manager
oracleenterprise manager database control
oracleenterprise manager grid control
oracleoracle10g
oracleoracle8i
oracleoracle9i

Public exploits

SourceTitleDate
exploit-dbOracle 9i/10g - 'extproc' Local/Remote Command Execution2006-12-19
exploit-dbOracle 9i - Multiple Vulnerabilities2004-08-04

References

→ the Explorer  ·  watch your stack  ·  NVD