$ cve CVE-2007-3855 JSON

CVE-2007-3855 EXPLOIT

6.5

MEDIUM · CVSS 2.0 · EPSS 15.8% (pctl 97)

Patch early

A public exploit exists.

Description

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17). NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.

Scoring

CVSS	6.5 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS	15.82% — more likely to be exploited than 97% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-07-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
oracle	database server

Public exploits

Source	Title	Date
exploit-db	Oracle 9i/10g - Evil Views Change Passwords	2007-07-19
exploit-db	Oracle Database - SQL Compiler Views Unauthorized Manipulation	2007-07-12

References

→ the Explorer · watch your stack · NVD