CVE-2014-2406

2014-04-1601:55:10

oracle

web.nvd.nist.gov

cve-2014-2406

oracle database server

rdbms

remote authenticated users

confidentiality

integrity

availability

nvd

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

AI Score

5.6

Confidence

Low

EPSS

0.087

Percentile

94.7%

JSON

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to “Advisor” and “Select Any Dictionary” privileges.

Affected configurations

Nvd

Node

oracledatabase_serverMatch11.1.0.7

oracledatabase_serverMatch11.2.0.3

oracledatabase_serverMatch11.2.0.4

oracledatabase_serverMatch12.1.0.1

VendorProductVersionCPE
oracledatabase_server11.1.0.7cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*
oracledatabase_server11.2.0.3cpe:2.3:a:oracle:database_server:11.2.0.3:*:*:*:*:*:*:*
oracledatabase_server11.2.0.4cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:*
oracledatabase_server12.1.0.1cpe:2.3:a:oracle:database_server:12.1.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	11.1.0.7	cpe:2.3:a:oracle:database_server:11.1.0.7:::::::*
oracle	database_server	11.2.0.3	cpe:2.3:a:oracle:database_server:11.2.0.3:::::::*
oracle	database_server	11.2.0.4	cpe:2.3:a:oracle:database_server:11.2.0.4:::::::*
oracle	database_server	12.1.0.1	cpe:2.3:a:oracle:database_server:12.1.0.1:::::::*