CVE

Id
4959  
CVE No.
CVE-2002-0568  
Status
Candidate  
Description
Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.  
Phase
Proposed (20020611)  
Votes
ACCEPT(4) Alderson, Baker, Cole, Wall | MODIFY(1) Frech | NOOP(2) Cox, Foat  
Comments
Frech> XF:oracle-appserver-config-file-access(8453)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
25538 4959 CVE-2002-0568 BUGTRAQ:20020206 Hackproofing Oracle Application Server paper  View
25539 4959 CVE-2002-0568 URL:http://marc.info/?l=bugtraq&m=101301813117562&w=2  View
25540 4959 CVE-2002-0568 CERT:CA-2002-08  View
25541 4959 CVE-2002-0568 URL:http://www.cert.org/advisories/CA-2002-08.html  View
25542 4959 CVE-2002-0568 CERT-VN:VU#476619  View
25543 4959 CVE-2002-0568 URL:http://www.kb.cert.org/vuls/id/476619  View
25544 4959 CVE-2002-0568 MISC:http://www.nextgenss.com/papers/hpoas.pdf  View
25545 4959 CVE-2002-0568 BID:4290  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63729 JVNDB-2002-000056 Oracle 製品の XSQLConfig.xml と soapConfig.xml における情報漏洩の脆弱性 Oracle 製品の "XSQLConfig.xml" と "soapConfig.xml" 設定ファイルは、クライアントから無認証アクセスが可能なため、バーチャルディレクトリを介することにより、これらのファイルが閲覧される脆弱性が存在します。 CVE-2002-0568 4959 2.1 http://jvndb.jvn.jp/ja/contents/2002/JVNDB-2002-000056.html  View