CVE-2004-1365: Oracle Application Server
Medium severity, CVSS 4.6. EPSS: 7.4% chance of exploitation in the next 30 days.
Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.
Affected products
- Oracle Application Server: any version; version 9.0.2 only; version 9.0.2.0.0 only; version 9.0.2.0.1 only; version 9.0.2.1 only; version 9.0.2.2 only; …
- Oracle Collaboration Suite: version release_1 only
- Oracle E-Business Suite: version 11.5.1 only; version 11.5.2 only; version 11.5.3 only; version 11.5.4 only; version 11.5.5 only; version 11.5.6 only; …
- Oracle Enterprise Manager: version 9 only; version 9.0.1 only
- Oracle Enterprise Manager Database Control: version 10.1.2 only
- Oracle Enterprise Manager Grid Control: version 10.1.0.2 only
- Oracle ORACLE10G: version enterprise_9.0.4_.0 only; version enterprise_10.1.0.2 only; version personal_9.0.4_.0 only; version personal_10.1_.0.2 only; version standard_9.0.4_.0 only; version standard_10.1_.0.2 only
- Oracle ORACLE8I: version enterprise_8.0.5_.0.0 only; version enterprise_8.0.6_.0.0 only; version enterprise_8.0.6_.0.1 only; version enterprise_8.1.5_.0.0 only; version enterprise_8.1.5_.0.2 only; version enterprise_8.1.5_.1.0 only; …
- Oracle ORACLE9I: version client_9.2.0.1 only; version client_9.2.0.2 only; version enterprise_8.1.7 only; version enterprise_9.0.1 only; version enterprise_9.0.1.4 only; version enterprise_9.0.1.5 only; …
Published 2004-08-04. Last modified 2026-06-16.