Description
Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServlet).
References
- 20020206 Hackproofing Oracle Application Server paper mailing-list
- CA-2002-08 third-party-advisory
- http://www.nextgenss.com/papers/hpoas.pdf
- VU#977251 third-party-advisory
- oracle-appserver-config-file-access(8453) vdb-entry
- 4298 vdb-entry