{"api_version":"1","generated_at":"2026-07-23T08:36:57+00:00","cve":"CVE-2002-0562","urls":{"html":"https://cve.report/CVE-2002-0562","api":"https://cve.report/api/cve/CVE-2002-0562.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0562","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0562"},"summary":{"title":"CVE-2002-0562","description":"The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-07-03 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/4034","name":"http://www.securityfocus.com/bid/4034","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle 9IAS OracleJSP Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.cert.org/advisories/CA-2002-08.html","name":"http://www.cert.org/advisories/CA-2002-08.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory","US Government Resource"],"title":"CERT Advisory CA-2002-08 Multiple Vulnerabilities in Oracle Servers","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/698467","name":"http://www.kb.cert.org/vuls/id/698467","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"CERT/CC Vulnerability Note VU#698467","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf","name":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Technical Resources | Oracle","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=101301440005580&w=2","name":"http://marc.info/?l=bugtraq&m=101301440005580&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'JSP translation file access under Oracle 9iAS' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0562","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0562","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_server","cpe6":"1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_server_web_cache","cpe6":"2.0.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_server_web_cache","cpe6":"2.0.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_server_web_cache","cpe6":"2.0.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_server_web_cache","cpe6":"2.0.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"oracle9i","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"562","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"oracle9i","cpe6":"9.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:56:38.175Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"CA-2002-08","tags":["third-party-advisory","x_refsource_CERT","x_transferred"],"url":"http://www.cert.org/advisories/CA-2002-08.html"},{"name":"VU#698467","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/698467"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf"},{"name":"4034","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/4034"},{"name":"20020206 JSP translation file access under Oracle 9iAS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=101301440005580&w=2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-02-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-10-17T13:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"CA-2002-08","tags":["third-party-advisory","x_refsource_CERT"],"url":"http://www.cert.org/advisories/CA-2002-08.html"},{"name":"VU#698467","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/698467"},{"tags":["x_refsource_CONFIRM"],"url":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf"},{"name":"4034","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/4034"},{"name":"20020206 JSP translation file access under Oracle 9iAS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=101301440005580&w=2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0562","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"CA-2002-08","refsource":"CERT","url":"http://www.cert.org/advisories/CA-2002-08.html"},{"name":"VU#698467","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/698467"},{"name":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf","refsource":"CONFIRM","url":"http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf"},{"name":"4034","refsource":"BID","url":"http://www.securityfocus.com/bid/4034"},{"name":"20020206 JSP translation file access under Oracle 9iAS","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=101301440005580&w=2"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0562","datePublished":"2002-06-11T04:00:00.000Z","dateReserved":"2002-06-07T00:00:00.000Z","dateUpdated":"2024-08-08T02:56:38.175Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-07-03 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"CC62E1B2-6964-4459-A1EF-A6A087C2960F"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_server_web_cache:2.0.0.0:*:*:*:*:*:*:*","matchCriteriaId":"2C272DE0-3717-40D0-99A6-2B4108BF85A3"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_server_web_cache:2.0.0.1:*:*:*:*:*:*:*","matchCriteriaId":"4959B7CD-218F-47A3-A604-629B69E1905B"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_server_web_cache:2.0.0.2:*:*:*:*:*:*:*","matchCriteriaId":"6659ECF3-D355-4357-BB15-DAFA427FCD12"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_server_web_cache:2.0.0.3:*:*:*:*:*:*:*","matchCriteriaId":"7B34A419-42C2-44FC-84C7-65699BA07120"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*","matchCriteriaId":"2C2720EA-55FB-40B1-BE58-3E16628DA248"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*","matchCriteriaId":"D9BB176D-7A94-4A91-89FC-9971E19FF7C6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"562","Ordinal":"1","Title":"CVE-2002-0562","CVE":"CVE-2002-0562","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"562","Ordinal":"1","NoteData":"The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.","Type":"Description","Title":"CVE-2002-0562"},{"CveYear":"2002","CveId":"562","Ordinal":"2","NoteData":"2002-06-11","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"562","Ordinal":"3","NoteData":"2016-10-17","Type":"Other","Title":"Modified"}]}}}