PT-2016-5125

CVE-2016-2346

Published

2016-04-25

Updated

2016-05-04

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allround Automations PL/SQL Developer version 11.0.6 and earlier, specifically versions prior to 11.0.6

Description The issue allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream, as the software relies on unverified HTTP data for updates.

Recommendations For versions prior to 11.0.6, update to version 11.0.6 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Adam Caudill

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

Related identifiers