CVE-2007-5561

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-10-18 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the logging function in the Oracle OPMN daemon, as used on Oracle Enterprise Grid Console server 10.2.0.1, allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP request to port 6003, aka Oracle reference number 6296175. NOTE: this might be the same issue as CVE-2007-0282 or CVE-2007-0280, but there are insufficient details to be sure.

Affected products

Oracle Enterprise Grid Console Server: 10.2.0.1
Oracle Opmn Daemon: all versions

References

http://www.irmplc.com/index.php/111-Vendor-Alerts
http://www.irmplc.com/index.php/142-Advisory-021
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
http://www.irmplc.com/index.php/111-Vendor-Alerts
http://www.irmplc.com/index.php/142-Advisory-021
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

Get alerted when CVE-2007-5561 or the next vulnerability affects your stack