Vulnerability Details : CVE-2005-2372
Potential exploit
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
Vulnerability category: Execute code
Products affected by CVE-2005-2372
- cpe:2.3:a:oracle:forms:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:9i:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:10g:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:forms:6i:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2005-2372
4.71%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 88 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2005-2372
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
References for CVE-2005-2372
Jump to