CVEvulnerability
CVE-2002-0562
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2002-07-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Description
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
Affected configurations
• oracle application server 1.0.2
• oracle application server web cache 2.0.0.0
• oracle application server web cache 2.0.0.1
• oracle application server web cache 2.0.0.2
• oracle application server web cache 2.0.0.3
• oracle oracle9i 9.0
• oracle oracle9i 9.0.1
References
- http://marc.info/?l=bugtraq&m=101301440005580&w=2 marc.info
- http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf Patch, Vendor Advisory
- http://www.cert.org/advisories/CA-2002-08.html Patch, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/698467 US Government Resource
- http://www.securityfocus.com/bid/4034 Patch, Vendor Advisory
- http://marc.info/?l=bugtraq&m=101301440005580&w=2 marc.info
- http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf Patch, Vendor Advisory
- http://www.cert.org/advisories/CA-2002-08.html Patch, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/698467 US Government Resource
- http://www.securityfocus.com/bid/4034 Patch, Vendor Advisory