CVE-2010-3600: oracle database_server
Vulnerability summary
CVE-2010-3600 is a high (CVSS 7.5) vulnerability in oracle database_server. EPSS estimates a 76.69% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 19-01-2011PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
76.69%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 76.69% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundOracle Database Client System Analyzer Arbitrary File Upload
exploit/windows/oracle/client_system_analyzer_upload
Maturity: weaponized
Oracle Database Client System Analyzer - Arbitrary File Upload (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle2 products
- database_server11.1.0.7 | 11.2.0.1
- enterprise_manager_grid_control10.2.0.5
1 vendor · 2 products
References
9 links- www.zerodayinitiative.com/advisories/ZDI-11-018/X Refsource MISC