Vulnerability Details : CVE-2009-0978
Public exploit exists!
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0975.
Exploit prediction scoring system (EPSS) score for CVE-2009-0978
86.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2009-0978
-
Oracle DB SQL Injection via SYS.LT.ROLLBACKWORKSPACE
Disclosure Date: 2009-05-04First seen: 2020-04-26auxiliary/sqli/oracle/lt_rollbackworkspaceThis module exploits a sql injection flaw in the ROLLBACKWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. Authors: - MC <mc@metasploit.com>
CVSS scores for CVE-2009-0978
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST |
References for CVE-2009-0978
-
http://www.us-cert.gov/cas/techalerts/TA09-105A.html
Third Party Advisory;US Government Resource
-
http://www.securitytracker.com/id?1022052
Third Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
Vendor Advisory
-
http://www.securityfocus.com/bid/34461
Third Party Advisory;VDB Entry
Products affected by CVE-2009-0978
- cpe:2.3:a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_11g:11.1.0.6:*:*:*:*:*:*:*