CVE-2008-2589: SQL Injection
Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.4.1 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability in the WWVRENDERREPORT package that allows remote attackers to execute arbitrary SQL (PL/SQL) commands via the second argument to the SHOW procedure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2589?
The severity of CVE-2008-2589 is currently unknown as Oracle has not provided specific details about its impact.
How do I fix CVE-2008-2589?
To mitigate CVE-2008-2589, ensure your Oracle Application Server is updated to the latest patches provided by Oracle.
Which Oracle Application Server versions are affected by CVE-2008-2589?
CVE-2008-2589 affects Oracle Application Server versions 9.0.4.3, 10.1.2.2, and 10.1.4.1.
Is there a public exploit for CVE-2008-2589?
There is no public exploit available for CVE-2008-2589 as of now, but it remains a potential vulnerability.
What components are impacted by CVE-2008-2589?
CVE-2008-2589 specifically impacts the Oracle Portal component within the Oracle Application Server.