CVE-2005-2372

State: Published
Severity: Not scored
Published: Jul 26, 2005
Updated: Aug 7, 2024
Reserved: Jul 26, 2005

Description

Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://www.red-database-security.com/advisory/oracle_forms_run_any_os_command.html
20050719 Oracle Security Advisory: Run any OS Command via unauthorized Oracle Formsmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.