CVE-2007-3860
Last modified
CVE-2007-3860 is a vulnerability of currently unknown severity. Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.. EPSS estimates a 1.95% chance of exploitation in the next 30 days.
Description
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Apex | <= 3.0.0.00.20 |
| Oracle | Apex | 2.2.0.00.32 |
References
- http://secunia.com/advisories/26114Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA07-200A.htmlUS Government Resource
- http://secunia.com/advisories/26114Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA07-200A.htmlUS Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-3860?
How severe is CVE-2007-3860?
How do I fix CVE-2007-3860?
Are you affected by CVE-2007-3860?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST