6.4

CVE-2012-3137

Media report
Exploit

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

Data is provided by the National Vulnerability Database (NVD)
Oracle ≫ Database Server Version10.2.0.3
Oracle ≫ Database Server Version10.2.0.4
Oracle ≫ Database Server Version10.2.0.5
Oracle ≫ Database Server Version11.1.0.7
Oracle ≫ Database Server Version11.2.0.2
Oracle ≫ Database Server Version11.2.0.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 54.2% 0.979
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://www.exploit-db.com/exploits/22069
Third Party Advisory
Exploit
VDB Entry