Unscored severity · published Apr 16, 2008
CVE-2008-1811
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher claims that APEX01 is for insufficient authorization checks for SQL commands in the run_ddl function in flows_030000.wwv_execute_immediate, allowing privilege escalation by certain non-DBA remote authenticated users.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Application Express · Oracle
3.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1811
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1811
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=690
Vendor Advisory
http://secunia.com/advisories/29829
Vendor Advisory
http://secunia.com/advisories/29874
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/491024/100/0/threaded
www.securitytracker.com
http://www.securitytracker.com/id?1019855
More from Application Express
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.0
CVE-2025-50067
Vulnerability in Oracle Application Express (component: Strategic Planner Starter App)
9.0
CVE-2023-21975
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account)
9.0
CVE-2023-21974
Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account)
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor