Vulnerability in Oracle Forms
CVE-2005-2372
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
EPSS: 0.029 (85.3th percentile) — read the EPSS interpretation.
Affected products
- Oracle Forms — versions 3.0, 4.5, 5.0
- N/a — versions n/a
References
- cve@mitre.org (Exploit, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)