Description
Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
Remediation
References
Related Vulnerabilities
ownCloud Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-1850)
Mailman Other Vulnerability (CVE-2006-1712)
Moodle Uncontrolled Resource Consumption Vulnerability (CVE-2021-32476)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4382)
Oracle Application Server Other Vulnerability (CVE-2005-3448)