CVE-2004-1338: The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add…

Unscored severity · published Dec 23, 2004

CVE-2004-1338

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add…

–

CVSS

1.2%

EPSS

On KEV

Description

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.2% · higher than 68% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Database Server · Oracle

10.2.1 · source: NVD

Oracle9i · Oracle

9.0; 9.0.1; 9.0.1.2; 9.0.1.3; 9.0.1.4; 9.0.2; +7 more · source: NVD