Oracle Database Server UTL_FILE Directory Traversal File Access

Medium Nessus Network Monitor Plugin ID 2680


The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files.


The remote host appears to be running a vulnerable version of Oracle Database Server. An authenticated user can craft SQL queries such that they would be able to retrieve any file on the system. An attacker exploiting this flaw would need a valid account and would need to be able to connect to the Oracle service (typically on port 2972). The attacker would retrieve and/or potentially modify confidential data on the target Oracle server.


Upgrade or patch according to vendor recommendations.

See Also

Plugin Details

Severity: Medium

ID: 2680

Family: Database

Published: 2005/03/08

Modified: 2016/02/05

Nessus ID: 17654

Risk Information

Risk Factor: Medium


Base Score: 6.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:H/RL:U/RC:ND


Base Score: 6.2

Temporal Score: 6.2


Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2005-0701

BID: 12749