CVE-2004-2115: Oracle HTTP Server iSQLPlus XSS via action, username and password parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw is a remotely reachable XSS in an administrative interface with public exploit references and high EPSS, but it requires user interaction and affects an old product version.

What it is

Oracle HTTP Server 1.3.22, an Apache-derived server, contains multiple reflected cross-site scripting flaws in the iSQLPlus component. The action, username and password request parameters are not properly sanitized, so injected script is returned to and executed in a victim's browser. Because iSQLPlus is a database administration interface, script execution in that context can expose privileged sessions.

Impact

An attacker can execute arbitrary script in the context of another user's browser session, potentially stealing session cookies or credentials and performing actions as that user. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

Reachable remotely over the network through crafted isqlplus requests carrying malicious action, username or password parameters; no authentication is required per the CVSS vector (Au:N), but exploitation requires some user interaction such as following a crafted link (AC:M).

Exploitation

No CISA KEV listing and no ransomware association; EPSS is high at 0.58352 (99th percentile), and SecurityFocus references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor patch or upgrade Oracle HTTP Server to a fixed release; this is a 2004-era flaw, so confirm current Oracle CPU guidance for the affected component.
• If iSQLPlus is not required, disable or block access to it, especially from untrusted networks.
• Deploy input validation and output encoding for the action, username and password parameters, or place a WAF rule in front of iSQLPlus.
• Restrict iSQLPlus access to trusted administrative networks and enforce strong session protections such as HttpOnly cookies.

Detection

• Search web and proxy logs for isqlplus requests containing script tags or encoded script in the action, username or password parameters.
• Alert on iSQLPlus access from unexpected source addresses or outside administrative maintenance windows.
• Monitor for anomalous session cookie use or requests following a suspicious isqlplus link, which may indicate session theft.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.