CVE-2004-1366: Oracle Application Server

Medium severity, CVSS 4.6. EPSS: 15.5% chance of exploitation in the next 30 days.

Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.

Affected products

• Oracle Application Server: any version; version 9.0.2 only; version 9.0.2.0.0 only; version 9.0.2.0.1 only; version 9.0.2.1 only; version 9.0.2.2 only; …
• Oracle Collaboration Suite: version release_1 only
• Oracle E-Business Suite: version 11.5.1 only; version 11.5.2 only; version 11.5.3 only; version 11.5.4 only; version 11.5.5 only; version 11.5.6 only; …
• Oracle Enterprise Manager: version 9 only; version 9.0.1 only
• Oracle Enterprise Manager Database Control: version 10.1.2 only
• Oracle Enterprise Manager Grid Control: version 10.1.0.2 only
• Oracle ORACLE10G: version enterprise_9.0.4_.0 only; version enterprise_10.1.0.2 only; version personal_9.0.4_.0 only; version personal_10.1_.0.2 only; version standard_9.0.4_.0 only; version standard_10.1_.0.2 only
• Oracle ORACLE8I: version enterprise_8.0.5_.0.0 only; version enterprise_8.0.6_.0.0 only; version enterprise_8.0.6_.0.1 only; version enterprise_8.1.5_.0.0 only; version enterprise_8.1.5_.0.2 only; version enterprise_8.1.5_.1.0 only; …
• Oracle ORACLE9I: version client_9.2.0.1 only; version client_9.2.0.2 only; version enterprise_8.1.7 only; version enterprise_9.0.1 only; version enterprise_9.0.1.4 only; version enterprise_9.0.1.5 only; …

Published 2004-08-04. Last modified 2026-06-16.