Description

Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.

Remediation

References

CVE-2002-0565

Related Vulnerabilities

WordPress Plugin Exquisite PayPal Donation Cross-Site Scripting (2.0.0)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0203)

WordPress Plugin WP-AutoYoutube 'index.php' Script SQL Injection (0.1)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-5319)

WordPress Plugin Webapp builder (Free mobile apps native iPhone iOS & Android Winphone mobile apps) Arbitrary File Upload (2.0)

Severity

Medium

Classification

CVE-2002-0565

Tags

Missing Update Known Vulnerabilities