Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-6488: Oracle Enterprise Manager lets authorized users alter data remotely

CVE-2014-6488 · published 12 years ago

Summary

Certain versions of Oracle Enterprise Manager Grid Control and Database Control may allow a user who is already logged in to change or corrupt managed data from a remote location. This could affect the accuracy of your database information. Apply the latest security updates from Oracle as soon as possible and review user access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	enterprise_manager_grid_control	10.2.0.5 11.1.0.1 12.1.0.4 12.1.0.5 12.1.0.6 `cpe:2.3:a:oracle:enterprise_manager_grid_control:10.2.0.5:::::::*`
oracle	enterprise_manager_database_control	11.1.0.7 11.2.0.3 11.2.0.4 `cpe:2.3:a:oracle:enterprise_manager_database_control:11.1.0.7:::::::*`

Original advisory text

Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform: 10.2.0.5, 11.1.0.1 EM DB Control: 11.1.0.7, 11.2.0.3, 11.2.0.4 EM Plugin for DB: 12.1.0.4, 12.1.0.5, and 12.1.0.6 allows remote authenticated users to affect integrity via unknown vectors related to Content Management.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Timeline

Published15 Oct 2014

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2014-6488 · NVD

Track software like this

Free during beta