Description
Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
References
- CA-2002-08 third-party-advisory
- 3341 vdb-entry
- 20010921 Response to "Path disclosure vulnerability in Oracle 9i and 8i mailing-list
- VU#278971 third-party-advisory
- 20010917 Yet another path disclosure vulnerability mailing-list
- http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf
- http://www.nii.co.in/research.html
- oracle-jsp-reveal-path(7135) vdb-entry