CVE-2001-1372: Oracle Application Server

Medium severity, CVSS 5.0. EPSS: 6.5% chance of exploitation in the next 30 days.

Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.

Affected products

• Oracle Application Server: version 1.0.2 only

Published 2002-02-06. Last modified 2026-06-16.