NetSight
IP …
medium5.0

CVE-2002-0565

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sens…

Impact

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.

Affected products

VendorProductAffected versions
OracleApplication Server
Version 1.0.2
OracleApplication Server Web Cache
Versions 2.0.0.0, 2.0.0.1, 2.0.0.2, 2.0.0.3
OracleOracle9i
Versions 9.0, 9.0.1

References