CVE-2004-1877

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-03-30 · updated 2026-06-16

Description

The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.

Affected products

Oracle Application Server: 1.0.2, 1.0.2.1s, 1.0.2.2, 1.0.2.2.2, 9.0.2, 9.0.2.0.0 (+6)
Oracle Corporation Oracle HTTP Server: 8.1.7, 9.0.1, 9.2.0

References

http://marc.info/?l=bugtraq&m=108067040722235&w=2
http://www.securityfocus.com/bid/10009
https://exchange.xforce.ibmcloud.com/vulnerabilities/15676
http://marc.info/?l=bugtraq&m=108067040722235&w=2
http://www.securityfocus.com/bid/10009
https://exchange.xforce.ibmcloud.com/vulnerabilities/15676

Get alerted when CVE-2004-1877 or the next vulnerability affects your stack