Oracle Application Server 9.0 - HTTP Service Mod_Access Restriction Bypass
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | Oracle Application Server Web Cache OHS mod_access Authentication Bypass | 28 Apr 200500:00 | – | nessus |
| Oracle Application Server Multiple Vulnerabilities | 24 Jan 201200:00 | – | nessus |
| Oracle Application Server Webcache Requests OHS mod_access Restriction Bypass | 2 May 200500:00 | – | nessus |
 | Oracle HTTP Server mod_access Restriction Bypass (CVE-2005-1383) | 22 Nov 200900:00 | – | checkpoint_advisories |
 | CVE-2005-1383 | 2 May 200504:00 | – | cve |
 | CVE-2005-1383 | 2 May 200504:00 | – | cvelist |
 | CVE-2005-1383 | 3 May 200504:00 | – | nvd |
source: https://www.securityfocus.com/bid/13418/info
Oracle HTTP Server(OHS) of Oracle Application Server is prone to an access restriction bypass vulnerability.
It is possible to configure a list of forbidden URIs in OHS. This is accomplished using 'mod_access'. A URI that is listed is not supposed to be accessible to certain clients, depending on the configuration. However, reports indicate that the Oracle Webcache client may be used to access URIs regardless of the restrictions outlined in OHS 'mod_access'.
(Port 7778 = Webcache, Port 7779 = OHS)
The following URLs are NOT protected if you access them via Webcache:
http://example.com:7778/dmsoc4j/AggreSpy?format=metrictable&nountype=ohs_child&orderby=Name
http://example.com:7778/server-status
http://example.com:7778/dms0
The following URLs are protected:
http://example.com:7779/dmsoc4j/AggreSpy?format=metrictable&nountype=ohs_child&orderby=Name
http://example.com:7779/server-status
http://example.com:7779/dms0Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 May 2013 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.30612