CVE-2004-1366

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-08-04 · updated 2026-06-16
Weakness: CWE-255

Description

Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.

Affected products

Oracle Application Server: 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2, 9.0.2.3 (+5)
Oracle Collaboration Suite: release_1
Oracle E-Business Suite: 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6 (+3)
Oracle Corporation Enterprise Manager for Fusion Middleware: 9, 9.0.1
Oracle Enterprise Manager Database Control: 10.1.2
Oracle Enterprise Manager Grid Control: 10.1.0.2
Oracle10G: enterprise_9.0.4_.0, enterprise_10.1.0.2, personal_9.0.4_.0, personal_10.1_.0.2, standard_9.0.4_.0, standard_10.1_.0.2
Oracle8I: enterprise_8.0.5_.0.0, enterprise_8.0.6_.0.0, enterprise_8.0.6_.0.1, enterprise_8.1.5_.0.0, enterprise_8.1.5_.0.2, enterprise_8.1.5_.1.0 (+13)
Oracle9I: client_9.2.0.1, client_9.2.0.2, enterprise_8.1.7, enterprise_9.0.1, enterprise_9.0.1.4, enterprise_9.0.1.5 (+30)

References

Get alerted when CVE-2004-1366 or the next vulnerability affects your stack