CVE-2005-2371: Oracle Reports

Medium severity, CVSS 5.0. EPSS: 22.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case it overlaps CVE-2006-0289.

Affected products

• Oracle Reports: version 6.0 only; version 6i only; version 9i only; version 10g only

Published 2005-07-26. Last modified 2026-06-16.