CVEvulnerability
CVE-2005-2378
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2005-07-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-22
Description
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
Affected configurations
• oracle reports
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://marc.info/?l=bugtraq&m=112181054226520&w=2 marc.info
- http://marc.info/?l=bugtraq&m=112181242916757&w=2 marc.info
- http://secunia.com/advisories/18493 Vendor Advisory
- http://secunia.com/advisories/18608 Vendor Advisory
- http://securitytracker.com/id?1014525 securitytracker.com
- http://securitytracker.com/id?1014527 securitytracker.com
- http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html Exploit, Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html Exploit, Vendor Advisory
- http://www.securityfocus.com/archive/1/422256/30/7430/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/0323 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 exchange.xforce.ibmcloud.com
- http://marc.info/?l=bugtraq&m=112181054226520&w=2 marc.info
- http://marc.info/?l=bugtraq&m=112181242916757&w=2 marc.info
- http://secunia.com/advisories/18493 Vendor Advisory
- http://secunia.com/advisories/18608 Vendor Advisory
- http://securitytracker.com/id?1014525 securitytracker.com
- http://securitytracker.com/id?1014527 securitytracker.com
- http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html Exploit, Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html Exploit, Vendor Advisory
- http://www.securityfocus.com/archive/1/422256/30/7430/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/0323 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 exchange.xforce.ibmcloud.com