CVE-2002-0565

3 documents3 sources
Severity
5.0MEDIUM
EPSS
5.9%
top 9.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Oracle Application ServerOracle Application Server WEB CacheOracle Oracle9i
Timeline
PublishedJul 3
Latest updateApr 30

Description

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDoracle/oracle9i9.0, 9.0.1+1
▶NVDoracle/application4 versions+3

Patches

Patch: otn.oracle.com ↗Patch: www.cert.org ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gq4w-3h72-frgx: Oracle 9iAS 1↗2022-04-30
▶
CVEList
CVE-2002-0565: Oracle 9iAS 1↗2002-06-11
▶
CVE-2002-0565 (MEDIUM CVSS 5) | Oracle 9iAS 1.0.2.x compiles JSP fi | cvebase.io