CVE-2004-1370: Oracle Application Server

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2) WK_ACL.GET_ACL, (3) WK_ACL.STORE_ACL, (4) WK_ADM.COMPLETE_ACL_SNAPSHOT, (5) WK_ACL.DELETE_ACLS_WITH_STATEMENT, or (6) DRILOAD.VALIDATE_STMT.

Affected products

Oracle Application Server: any version; version 9.0.2 only; version 9.0.2.0.0 only; version 9.0.2.0.1 only; version 9.0.2.1 only; version 9.0.2.2 only; …
Oracle Collaboration Suite: version release_1 only
Oracle E-Business Suite: version 11.5.1 only; version 11.5.2 only; version 11.5.3 only; version 11.5.4 only; version 11.5.5 only; version 11.5.6 only; …
Oracle Enterprise Manager: version 9 only; version 9.0.1 only
Oracle Enterprise Manager Database Control: version 10.1.2 only
Oracle Enterprise Manager Grid Control: version 10.1.0.2 only
Oracle ORACLE10G: version enterprise_9.0.4_.0 only; version enterprise_10.1.0.2 only; version personal_9.0.4_.0 only; version personal_10.1_.0.2 only; version standard_9.0.4_.0 only; version standard_10.1_.0.2 only
Oracle ORACLE8I: version enterprise_8.0.5_.0.0 only; version enterprise_8.0.6_.0.0 only; version enterprise_8.0.6_.0.1 only; version enterprise_8.1.5_.0.0 only; version enterprise_8.1.5_.0.2 only; version enterprise_8.1.5_.1.0 only; …
Oracle ORACLE9I: version client_9.2.0.1 only; version client_9.2.0.2 only; version enterprise_8.1.7 only; version enterprise_9.0.1 only; version enterprise_9.0.1.4 only; version enterprise_9.0.1.5 only; …

Published 2004-08-04. Last modified 2026-06-16.