1. CVE-Search
  2. CVE-2005-3203
ID CVE-2005-3203
Summary The manual installation of Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:html_db:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:html_db:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:html_db:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:html_db:1.3.6:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 11-07-2017 - 01:33)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 15033
bugtraq 20051007 Plaintext Password Vulnerabilitiy during Installation of Oracle
fulldisc 20051007 Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB
misc http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.html
secunia 14935
xf oracle-htmldb-install-plaintext-password(22542)
Last major update 11-07-2017 - 01:33
Published 14-10-2005 - 10:02
Last modified 11-07-2017 - 01:33
Back to Top