Oracle 9i HTTP Server soapConfig.xml Access Information Disclosure - Ver2 (CVE-2002-0568)

An information disclosure vulnerability has been reported in Oracle 9i Application Server. A remote attacker could trigger this vulnerability by requesting XSQLConfig.xml or soapConfig.xml through a virtual directory. Successful exploitation of this vulnerability would allow a remote attacker to...

CVE-2002-0568: Undefined Security Weakness

Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting 1 XSQLConfig.xml or 2 soapConfig.xml through a virtual directory...

Oracle 9iAS default configuration allows arbitrary users to view sensitive configuration files

Overview It is possible to read the "XSQLConfig.xml" and "soapConfig.xml" configuration files from an Oracle 9i Application Server under the default installation without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially...