What’s Vulnerable › Vulnerabilities

CVE-2004-1368

• Severity: high (CVSS 7.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2004-08-04 · updated 2026-06-16

Description

ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.

Affected products

• Oracle Application Server: 9.0.2, 9.0.2.0.0, 9.0.2.0.1, 9.0.2.1, 9.0.2.2, 9.0.2.3 (+5)
• Oracle Collaboration Suite: release_1
• Oracle E-Business Suite: 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6 (+3)
• Oracle Corporation Enterprise Manager for Fusion Middleware: 9, 9.0.1
• Oracle Enterprise Manager Database Control: 10.1.2
• Oracle Enterprise Manager Grid Control: 10.1.0.2
• Oracle10G: enterprise_9.0.4_.0, enterprise_10.1.0.2, personal_9.0.4_.0, personal_10.1_.0.2, standard_9.0.4_.0, standard_10.1_.0.2
• Oracle8I: enterprise_8.0.5_.0.0, enterprise_8.0.6_.0.0, enterprise_8.0.6_.0.1, enterprise_8.1.5_.0.0, enterprise_8.1.5_.0.2, enterprise_8.1.5_.1.0 (+13)
• Oracle9I: client_9.2.0.1, client_9.2.0.2, enterprise_8.1.7, enterprise_9.0.1, enterprise_9.0.1.4, enterprise_9.0.1.5 (+30)

References

• http://marc.info/?l=bugtraq&m=110382264415387&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
• http://www.kb.cert.org/vuls/id/435974
• http://www.ngssoftware.com/advisories/oracle23122004E.txt
• http://www.securityfocus.com/bid/10871
• http://www.us-cert.gov/cas/techalerts/TA04-245A.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18656
• http://marc.info/?l=bugtraq&m=110382264415387&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
• http://www.kb.cert.org/vuls/id/435974
• http://www.ngssoftware.com/advisories/oracle23122004E.txt
• http://www.securityfocus.com/bid/10871

Get alerted when CVE-2004-1368 or the next vulnerability affects your stack