Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect conf…

published 2009-04-15 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0978

cvss: 4.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 5.3%; EPSS 5.3% chance of exploitation in 30 days, percentile 92%
public exploits: 1; Exploit-DB

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue allows remote authenticated users to obtain APEX password hashes from the WWV_FLOW_USERS table via a SELECT statement.

Timeline

2009-04-15 Published
2009-04-16 First public exploit (EDB-8456)

Exploit prediction

5.28% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-8456 Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes local, 2009-04-16

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

References

exploit-db.com /exploits/8456
exploit
securityfocus.com /bid/34461
vdb-entry
secunia.com /advisories/34693
third-party-advisory
us-cert.gov /cas/techalerts/TA09-105A.html
third-party-advisory, us-government-resource
securityfocus.com /archive/1/502724/100/0/threaded
mailing-list
red-database-security.com /advisory/apex_password_hashes.html
oracle.com /technetwork/topics/security/cpuapr2009-099563.html
osvdb.org /53738
vdb-entry
securitytracker.com /id?1022052
vdb-entry

Sources

CVE List CVE-2009-0981
NVD CVE-2009-0981

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary