CVE-2005-2378: Path Traversal
First published: Tue Jul 26 2005(Updated: )
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Reports |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html
- http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html
- http://securitytracker.com/id?1014525
- http://securitytracker.com/id?1014527
- http://secunia.com/advisories/18493
- http://secunia.com/advisories/18608
- http://www.vupen.com/english/advisories/2006/0323
- http://marc.info/?l=bugtraq&m=112181054226520&w=2
- http://marc.info/?l=bugtraq&m=112181242916757&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
- http://www.securityfocus.com/archive/1/422256/30/7430/threaded
Frequently Asked Questions
What is the severity of CVE-2005-2378?
CVE-2005-2378 is classified as a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2005-2378?
To fix CVE-2005-2378, apply the latest patches and updates provided by Oracle for Oracle Reports.
What kind of attacks can exploit CVE-2005-2378?
CVE-2005-2378 can be exploited by remote attackers to read arbitrary files on the server.
Which versions of Oracle Reports are affected by CVE-2005-2378?
CVE-2005-2378 affects all versions of Oracle Reports that are vulnerable without the security updates applied.
Is there a known exploit for CVE-2005-2378?
Yes, CVE-2005-2378 has known exploit vectors that allow unauthorized access to server files through the vulnerable parameters.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/tags
- agent/description
- agent/event
- agent/source
- vendor/oracle
- canonical/oracle reports