PT-2002-3057 · Oracle · Oracle 9I Application Server

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2345

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server version 9.0.2

Description The issue allows remote attackers to gain access due to the storage of the web cache administrator interface password in plaintext.

Recommendations For Oracle 9i Application Server version 9.0.2, consider changing the password storage mechanism to a more secure method, such as hashing, to prevent unauthorized access. As a temporary workaround, restrict access to the web cache administrator interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2002-2345

Affected Products

Oracle 9I Application Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-2345 · Security Note
• http://iss.net/security_center/static/9841.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2345 · Note
• http://otn.oracle.com/deploy/security/pdf/2002alert39rev1.pdf · Note
• http://securityfocus.com/bid/7395 · Note