CVE-2005-4871

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-264

Description

Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create or overwrite files via (1) XMLFileFromVarchar or (2) XMLFileFromClob, or read files via (3) XMLVarcharFromFile or (4) XMLClobFromFile.

Affected products

IBM Db2 for Linux, UNIX and Windows: 8.1

References

http://marc.info/?l=bugtraq&m=110495620513954&w=2
http://secunia.com/advisories/12733/
http://www.ngssoftware.com/advisories/db205012005I.txt
http://www.securityfocus.com/bid/12170
https://exchange.xforce.ibmcloud.com/vulnerabilities/18761
http://marc.info/?l=bugtraq&m=110495620513954&w=2
http://secunia.com/advisories/12733/
http://www.ngssoftware.com/advisories/db205012005I.txt
http://www.securityfocus.com/bid/12170
https://exchange.xforce.ibmcloud.com/vulnerabilities/18761

Get alerted when CVE-2005-4871 or the next vulnerability affects your stack