Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-3977: Oracle Application Server Portal can be tampered with remotely

CVE-2008-3977 · published 18 years ago

Summary

The Portal component in Oracle Application Server versions 9.0.4.3 and 10.1.2.3 can be altered by an attacker from outside the network. This could let someone change data or settings without authorization. Apply the latest security patches from Oracle as soon as possible to protect the system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	application_server	9.0.4.3 10.1.2.3 `cpe:2.3:a:oracle:application_server:9.0.4.3:::::::*`

Original advisory text

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 and 10.1.2.3 allows remote attackers to affect integrity via unknown vectors, a different vulnerability...

References

http://secunia.com/advisories/32291 Permissions Required
http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html Vendor Advisory
http://www.securitytracker.com/id?1021054 Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2008/2825 Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/45883

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published14 Oct 2008

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2008-3977 · NVD

Track software like this

Free during beta