Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-3979

4 documents4 sources

Severity

5.5MEDIUM

EPSS

51.6%

top 2.11%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle Database 10G

Timeline

PublishedJan 14

Latest updateMay 2

Description

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 8.0 | Impact: 4.9

Affected Packages1 packages

▶NVDoracle/database_10g10.1.0.5, 10.2.0.2+1

🔴Vulnerability Details

GHSA

GHSA-694p-gxgr-87cq: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10↗2022-05-02

▶

CVEList

CVE-2008-3979: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10↗2009-01-14

▶

💥Exploits & PoCs

Exploit-DB

Oracle 10g - MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (Metasploit)↗2009-02-18

▶