CVE-2002-0565

No fix known EPSS 6%

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.

Published 2002-06-11 · CVE record · OSV

Products: oracle application_server, oracle application_server_web_cache, oracle9i