CVE-2002-0565: Medium severity Oracle Application Server vulnerability
Oracle 9iAS 1.0.2.x compiles JSP files in the pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to pages.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0565?
CVE-2002-0565 has a medium severity, as it allows remote attackers to access sensitive information.
How do I fix CVE-2002-0565?
To fix CVE-2002-0565, restrict the permissions of the _pages directory to prevent world-readable access.
Which versions are affected by CVE-2002-0565?
CVE-2002-0565 affects Oracle products including Oracle 9iAS 1.0.2.x and some specific versions of Application Server Web Cache.
What types of sensitive information can be exposed due to CVE-2002-0565?
CVE-2002-0565 can expose sensitive information such as usernames and passwords embedded in JSP files.
Is CVE-2002-0565 still a threat today?
While CVE-2002-0565 is an older vulnerability, it remains a threat for systems that have not been updated or configured correctly.