CVE-2002-0563

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.0MEDIUM
EPSS
34.5%
top 3.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Oracle Application ServerOracle Application Server WEB CacheOracle Oracle8i+1 more
Timeline
PublishedJul 3
Latest updateApr 30

Description

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDoracle/application4 versions+3
▶NVDoracle/oracle8i8.1.7, 8.1.7_.1+1
▶NVDoracle/oracle9i9.0, 9.0.1+1

Patches

Patch: otn.oracle.com ↗Patch: www.cert.org ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c5h7-mjwp-4pvr: The default configuration of Oracle 9i Application Server 1↗2022-04-30
▶
CVEList
CVE-2002-0563: The default configuration of Oracle 9i Application Server 1↗2002-06-11
▶