01 Record

CVE-2004-1366

Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 15.50% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 96.5% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2005-01-19 05:00Z21 YR AGO

Last updated

2024-08-08 00:46Z2 YR AGO

Reserved

2005-01-07

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-255

Data version

5.1

Document digest

064aff3064f1a208b3cd6f26b998aed1be72ba8f8b47b9fb0a33e7b1a997535e

05 Affected products

VendorProductVersionsPlatforms

oracleapplication_serverNot specified—

oraclecollaboration_suiteNot specified—

oraclee-business_suiteNot specified—

oracleenterprise_managerNot specified—

oracleenterprise_manager_database_controlNot specified—

oracleenterprise_manager_grid_controlNot specified—

oracleoracle10gNot specified—

oracleoracle8iNot specified—

oracleoracle9iNot specified—

06 References

exchange.xforce.ibmcloud.comoracle-sysman-password-plaintext(18661)https://exchange.xforce.ibmcloud.com/vulnerabilities/18661vdb-entryx_refsource_XF
www.securityfocus.com20041223 Oracle clear text passwords (#NISR2122004D)http://www.securityfocus.com/archive/1/385323mailing-listx_refsource_BUGTRAQ
www.kb.cert.orgVU#316206http://www.kb.cert.org/vuls/id/316206third-party-advisoryx_refsource_CERT-VN
www.us-cert.govTA04-245Ahttp://www.us-cert.gov/cas/techalerts/TA04-245A.htmlthird-party-advisoryx_refsource_CERT
www.ngssoftware.comhttp://www.ngssoftware.com/advisories/oracle23122004D.txtx_refsource_MISC
www.securityfocus.com10871http://www.securityfocus.com/bid/10871vdb-entryx_refsource_BID
www.oracle.comhttp://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfx_refsource_CONFIRM
sunsolve.sun.com101782http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1vendor-advisoryx_refsource_SUNALERT

01 Record index

CVE-2004-1366

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2004-1366

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References