Unrated severityNVD Advisory· Published Aug 4, 2004· Updated Apr 16, 2026

CVE-2004-1362

Description

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.

Affected products

Oracle Corporation/Application Server12 versions
cpe:2.3:a:oracle:application_server:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:oracle:application_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_server:9.0.4.1:*:*:*:*:*:*:*
Oracle Corporation/Collaboration Suite
cpe:2.3:a:oracle:collaboration_suite:release_1:*:*:*:*:*:*:*
Oracle Corporation/E Business Suite9 versions
cpe:2.3:a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:oracle:e-business_suite:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager2 versions
cpe:2.3:a:oracle:enterprise_manager:9:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:enterprise_manager:9:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager:9.0.1:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Database Control
cpe:2.3:a:oracle:enterprise_manager_database_control:10.1.2:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Grid Control
cpe:2.3:a:oracle:enterprise_manager_grid_control:10.1.0.2:*:*:*:*:*:*:*
Oracle Corporation/Oracle10g6 versions
cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4_.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle10g:personal_10.1_.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle10g:personal_9.0.4_.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle10g:standard_10.1_.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle10g:standard_9.0.4_.0:*:*:*:*:*:*:*
Oracle Corporation/Oracle8i19 versions
cpe:2.3:a:oracle:oracle8i:enterprise_8.0.5_.0.0:*:*:*:*:*:*:*+ 18 more
- cpe:2.3:a:oracle:oracle8i:enterprise_8.0.5_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.0.6_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.0.6_.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.5_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.5_.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.5_.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.6_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.6_.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.7_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.7_.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:enterprise_8.1.7_.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.0.6_.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.7_.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.7_.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle8i:standard_8.1.7_.4:*:*:*:*:*:*:*
Oracle Corporation/Oracle9i36 versions
cpe:2.3:a:oracle:oracle9i:client_9.2.0.1:*:*:*:*:*:*:*+ 35 more
- cpe:2.3:a:oracle:oracle9i:client_9.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:client_9.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.0.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:enterprise_9.2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.0.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:personal_9.2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oracle9i:standard_9.2.0.5:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.ngssoftware.com/advisories/oracle23122004G.txtnvdPatchVendor Advisory
www.oracle.com/technology/deploy/security/pdf/2004alert68.pdfnvdPatchVendor Advisory
www.securityfocus.com/bid/10871nvdPatch
www.us-cert.gov/cas/techalerts/TA04-245A.htmlnvdPatchThird Party AdvisoryUS Government Resource
www.kb.cert.org/vuls/id/435974nvdThird Party AdvisoryUS Government Resource
marc.infonvd
sunsolve.sun.com/search/document.donvd
exchange.xforce.ibmcloud.com/vulnerabilities/18657nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000