CVE-1999-1125: Oracle HTTP Server

High severity, CVSS 10.0. EPSS: 3.7% chance of exploitation in the next 30 days.

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.

Affected products

• Oracle HTTP Server: up to and including 2.1; version 1.0 only

Published 1997-09-19. Last modified 2026-06-16.