---
id: 8234
title: "Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)"
cve: CVE-2014-4278
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/advisory-oracle-forms-10g-unauthenticated-remote-code-execution-cve-2014-4278/"
published_at: "2014-10-14T00:00:00Z"
tags: ["rce", "web-security", "input-validation", "oracle", "cve-2014-4278", "oracle-forms"]
phying_url: "https://phying.com/item/8234"
lang: en
---

# Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)

## Summary

Oracle Forms 10g fails to validate the ifip parameter passed to ListenerServlet, letting unauthenticated attackers execute arbitrary commands; E-Business Suite 12.0.6-12.2.4 is also affected.

## Intelligence Metadata

- **Sources:** netspi.com
- **CVE:** CVE-2014-4278
- **Published:** 2014-10-14T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/advisory-oracle-forms-10g-unauthenticated-remote-code-execution-cve-2014-4278/
- **Phying News:** https://phying.com/item/8234