CVE-2001-1372: Medium severity Oracle Application Server vulnerability

Published Feb 6, 2002

Updated

Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.

Affected Software

1 affected component

Oracle Application Server=1.0.2

Remediation

Patch Available

http://www.securityfocus.com/bid/3341

Event History

Feb 6, 2002

CVE Published

05:00 AM

Apr 2, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1372?

CVE-2001-1372 has a medium severity as it allows remote attackers to expose sensitive system information.

How do I fix CVE-2001-1372?

To fix CVE-2001-1372, ensure that you upgrade to a patched version of the Oracle Application Server that addresses this vulnerability.

What applications are affected by CVE-2001-1372?

CVE-2001-1372 specifically affects Oracle Application Server version 1.0.2.

What kind of attacks can be performed due to CVE-2001-1372?

Attackers can exploit CVE-2001-1372 to obtain the physical file path of a sensitive location on the server.

Is CVE-2001-1372 still a concern for modern applications?

While CVE-2001-1372 pertains to older software, it highlights the importance of maintaining current software to mitigate such vulnerabilities.