Unscored CVE-2002-0565 EUVD-2002-0560GHSA-gq4w-3h72-frgx

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote atta…

Published Jun 11, 2002 · Updated Aug 8, 2024 · Assigned by mitre

Description

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.

References

CA-2002-08 third-party-advisory
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
VU#547459 third-party-advisory
oracle-appserver-oraclejsp-view-info(8100) vdb-entry
4034 vdb-entry
20020206 JSP translation file access under Oracle 9iAS mailing-list