CVE-2002-0562

The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.

Published: Jul 3, 2002
Updated: Apr 13, 2023
CVE: CVE-2002-0562
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
oracle / oracle9i	9.0.1	9.0.1.x
oracle / application_server_web_cache	2.0.0.2	2.0.0.2.x
oracle / oracle9i	9.0	9.0.x
oracle / application_server_web_cache	2.0.0.1	2.0.0.1.x
oracle / application_server_web_cache	2.0.0.0	2.0.0.0.x
oracle / application_server	1.0.2	1.0.2.x
oracle / application_server_web_cache	2.0.0.3	2.0.0.3.x

http://marc.info/?l=bugtraq&m=101301440005580&w=2
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://www.cert.org/advisories/CA-2002-08.html
http://www.kb.cert.org/vuls/id/698467
http://www.securityfocus.com/bid/4034

Vulnerability Database

289,697

CVE-2002-0562