CVE-2002-0561

3 documents3 sources
Severity
7.5HIGH
EPSS
4.3%
top 11.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Oracle Application ServerOracle Application Server WEB CacheOracle Oracle8i+1 more
Timeline
PublishedJul 3
Latest updateApr 30

Description

The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶NVDoracle/application4 versions+3
▶NVDoracle/oracle8i8.1.7, 8.1.7_.1+1
▶NVDoracle/oracle9i9.0, 9.0.1+1

Patches

Patch: otn.oracle.com ↗Patch: www.kb.cert.org ↗Patch: otn.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-32v3-pxcv-g5fm: The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1↗2022-04-30
▶
CVEList
CVE-2002-0561: The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1↗2002-06-11
▶
CVE-2002-0561 (HIGH CVSS 7.5) | The default configuration of the PL | cvebase.io