CVE-2010-3594 SQL injection in n/a
Remote attackers can compromise confidentiality and integrity in Oracle Enterprise Manager Grid Control via SQL injection in the Real User Experience Insight component.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-3594?
CVE-2010-3594 is a medium-severity SQL injection vulnerability in Oracle Enterprise Manager Grid Control, published on 19 Jan 2011. It can be exploited over the network, with no action from the victim.
Official description
Unspecified vulnerability in the Real User Experience Insight component in Oracle Enterprise Manager Grid Control 6.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Processing. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this is SQL injection in rsynclogdird involving improper escaping of UTF-8 characters while processing log files.
Which versions are affected by CVE-2010-3594?
It affects 1 product.
Products include Oracle Enterprise Manager Grid Control.
How do I fix CVE-2010-3594?
No fix has been published for CVE-2010-3594 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2010-3594 being exploited?
There is no known exploitation of CVE-2010-3594 in the wild and no public exploit code.
Other vulnerabilities in Oracle Enterprise Manager Grid Control
Sources
Also known as GHSA-75pm-pvvg-r2qr.