CVE-2002-0568

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101301813117562&w=2
http://www.cert.org/advisories/CA-2002-08.htmlPatch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/476619Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4290Vendor Advisory
http://marc.info/?l=bugtraq&m=101301813117562&w=2
http://www.cert.org/advisories/CA-2002-08.htmlPatch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/476619Patch, Third Party Advisory, US Government Resource
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4290Vendor Advisory

Timeline

Published: Jul 3, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-05697.5Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL CVE-2002-05702.1The encrypted loop device in Linux kernel 2.4.10 and earlier does not authenticate the entity that is encrypting data, which allows local us CVE-2002-05717.5Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.CVE-2002-05727.2FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by clo CVE-2002-05737.5Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code vi CVE-2002-05745.0Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that t CVE-2002-05757.5Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, CVE-2002-05765.0ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP r CVE-2002-05772.1Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service.CVE-2002-05787.5Buffer overflow in 4D WebServer 6.7.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP r CVE-2002-05797.5WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminpro CVE-2002-05807.5WorkforceROI Xpede 4.1 allows remote attackers to obtain the database username via a request to datasource.asp, which leaks the username in