CVE-2002-0562 The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information includ...
MediumCVSS 5.0
EPSS 7.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle application server | = 1.0.2 | No fix listed |
| oracle application server web cache | = 2.0.0.0 | No fix listed |
| oracle application server web cache | = 2.0.0.1 | No fix listed |
| oracle application server web cache | = 2.0.0.2 | No fix listed |
| oracle application server web cache | = 2.0.0.3 | No fix listed |
| oracle9i | = 9.0 | No fix listed |
| oracle9i | = 9.0.1 | No fix listed |
References
- 20020206 JSP translation file access under Oracle 9iAS mailing-list
- otn.oracle.com patch vendor-advisory
- CA-2002-08 patch third-party-advisory us-government-resource
- VU#698467 third-party-advisory us-government-resource
- 4034 patch vdb-entry vendor-advisory