$ cve CVE-2008-3979 JSON

CVE-2008-3979 EXPLOIT

5.5

MEDIUM · CVSS 2.0 · EPSS 32.4% (pctl 98)

Patch early

A public exploit exists.

Description

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.

Scoring

CVSS	5.5 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:N
EPSS	32.43% — more likely to be exploited than 98% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2009-01-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
oracle	database 10g

Public exploits

Source	Title	Date
exploit-db	Oracle 10g - MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (Metasploit)	2009-02-18

References

→ the Explorer · watch your stack · NVD