Description

The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.

Remediation

References

CVE-2002-0562

Related Vulnerabilities

MySQL CVE-2019-2681 Vulnerability (CVE-2019-2681)

Oracle Database Server CVE-2014-6483 Vulnerability (CVE-2014-6483)

WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress SQL Injection (3.7.39)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Security Bypass (3.1.0)

Python Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2018-1000802)

Severity

Medium

Classification

CVE-2002-0562

Tags

Missing Update Known Vulnerabilities