Vulnerability in Oracle HTTP Server

CVE-1999-1125

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.

Published · last modified .

CVSS v2 metric

CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.037 (89.3th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-1999-1125: held from 0.037 to 0.037.

EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: -0.000

Affected products

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-1999-1125?
CVE-1999-1125 is a vulnerability in Oracle HTTP Server. Published 1997-09-19.
Is CVE-1999-1125 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.