ID CVE-2002-0568
Summary Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 18-10-2016 - 02:20)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bid 4290
bugtraq 20020206 Hackproofing Oracle Application Server paper
cert CA-2002-08
cert-vn VU#476619
misc http://www.nextgenss.com/papers/hpoas.pdf
Last major update 18-10-2016 - 02:20
Published 03-07-2002 - 04:00
Back to Top