CVE-2009-1991

2009-10-2218:30:00

oracle

web.nvd.nist.gov

cve-2009-1991

oracle

database

vulnerability

oracle text

sql injection

confidentiality

integrity

ctxsys.drvxtabc

nvd

CVSS2

3.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:P/A:N

AI Score

6.5

Confidence

Low

EPSS

0.177

Percentile

96.2%

JSON

Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an established researcher that this is for multiple SQL injection vulnerabilities via the (1) idx_owner or (2) idx_name parameters to the create_tables procedure.

Affected configurations

Nvd

Node

oracledatabase_serverMatch9.2.0.8

oracledatabase_serverMatch9.2.0.8dv

oracledatabase_serverMatch10.1.0.5

oracledatabase_serverMatch10.2.0.4

VendorProductVersionCPE
oracledatabase_server9.2.0.8cpe:2.3:a:oracle:database_server:9.2.0.8:*:*:*:*:*:*:*
oracledatabase_server9.2.0.8dvcpe:2.3:a:oracle:database_server:9.2.0.8dv:*:*:*:*:*:*:*
oracledatabase_server10.1.0.5cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*
oracledatabase_server10.2.0.4cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	9.2.0.8	cpe:2.3:a:oracle:database_server:9.2.0.8:::::::*
oracle	database_server	9.2.0.8dv	cpe:2.3:a:oracle:database_server:9.2.0.8dv:::::::*
oracle	database_server	10.1.0.5	cpe:2.3:a:oracle:database_server:10.1.0.5:::::::*
oracle	database_server	10.2.0.4	cpe:2.3:a:oracle:database_server:10.2.0.4:::::::*