CVE-2004-2115

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 58.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.

Affected products

Oracle Corporation Oracle HTTP Server: 8.1.7, 9.0.1, 9.2.0

References

http://marc.info/?l=bugtraq&m=107496560106967&w=2
http://www.securityfocus.com/bid/9484
https://exchange.xforce.ibmcloud.com/vulnerabilities/14930
http://marc.info/?l=bugtraq&m=107496560106967&w=2
http://www.securityfocus.com/bid/9484
https://exchange.xforce.ibmcloud.com/vulnerabilities/14930

Get alerted when CVE-2004-2115 or the next vulnerability affects your stack