{
  "id": "CVE-2006-7141",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2007-03-07T20:19:00.000",
  "lastModified": "2024-11-21T00:24:29.267",
  "vulnStatus": "Modified",
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or \"CREATE ANY DIRECTORY to PUBLIC\" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701.  NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability"
    },
    {
      "lang": "es",
      "value": "** IMPUGNADO ** Vulnerabilidad de escalado de ruta en el Servidor de Base de Datos Oracle, cuando el utl_file_dir est\u00e1 establecido a un valor comod\u00edn o existen privilegios de \"CREATE ANY DIRECTORY to PUBLIC\", permite a usuarios remotos autenticados leer y modificar ficheros de su elecci\u00f3n pasando rutas completas de ficheros a la funci\u00f3n utl_file como la (1) utl_file.put_line y(2) utl_file.get_line, vulnerabilidad relacionada con la CVE-2005-0701. NOTA: esta vulnerabilidad est\u00e1 impugnada por terceras partes que determinan que esto se debe a una configuraci\u00f3n insegura en vez de ser propiamente una vulnerabilidad."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "baseScore": 6.0,
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A77562B-D1A5-450D-9288-3FC7145E9292"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.0xdeadbeef.info/exploits/raptor_orafile.sql",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "http://www.securityfocus.com/archive/1/454862/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/454964/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/455047/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}