CVE-2005-3203

Published: Oct 14, 2005Modified: Apr 16, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

The manual installation of Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges.

Affected (2)

Products: Oracle: Html Db

Oracle

1 product

Html Db

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Html Db	Version 1.3.6
Oracle Html Db	Version 1.3

References (12)

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=112870441917345&w=2

Source: cve@mitre.org

http://secunia.com/advisories/14935/

Source: cve@mitre.org

Vendor Advisory

http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.html

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/15033

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/22542

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html