Description
Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue allows remote authenticated users to obtain APEX password hashes from the WWV_FLOW_USERS table via a SELECT statement.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Alexander Kornbrust · textlocalmultiple
https://www.exploit-db.com/exploits/8456
References (9)
Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/34461
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34693
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-105A.html
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502724/100/0/threaded
Vendor Advisory x_refsource_misc
http://www.red-database-security.com/advisory/apex_password_hashes.html
Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/53738
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1022052
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/8456
Scores
EPSS
0.3285
EPSS Percentile
96.9%
Details
Status
published
Products (1)
oracle/database_11g
11.1.0.7
Published
Apr 15, 2009
Tracked Since
Feb 18, 2026