CVE-2001-1372

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2001

CVE-2001-13735.0MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, whiCVE-2001-13747.2expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges viCVE-2001-13754.6tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local uCVE-2001-13767.5Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and pCVE-2001-13775.0Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers tCVE-2001-13782.1fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.CVE-2001-13797.5The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authenticCVE-2001-13807.5OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handleCVE-2001-13825.0The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriCVE-2001-13836.2initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized operCVE-2001-13847.2ptrace in Linux 2.2.x through 2.2.19, and 2.4.x through 2.4.9, allows local users to gain root privileges by running ptrace on a setuid or sCVE-2001-13855.0The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for othe
CVE-2001-1372: Medium severity, CVSS 5.0 | Vulnix