Vulnerability Details : CVE-2008-3996
Public exploit exists!
Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_CDC_IPUBLISH.
Products affected by CVE-2008-3996
- cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-3996
39.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2008-3996
-
Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE
Disclosure Date: 2008-10-22First seen: 2020-04-26auxiliary/sqli/oracle/dbms_cdc_ipublishThe module exploits an sql injection flaw in the ALTER_HOTLOG_INTERNAL_CSOURCE procedure of the PL/SQL package DBMS_CDC_IPUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTE_CATAL
CVSS scores for CVE-2008-3996
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST |
References for CVE-2008-3996
Jump to