CVE-2001-1372: Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the...

Security readout for executives and security teams

This is an old Oracle 9i Application Server 1.0.2 information disclosure issue. A malformed request for a missing JSP file can make the server reveal the physical filesystem path in an error message. That information can help later attacks, but the source bundle does not show code execution or active exploitation. Exposure is most likely limited to legacy Oracle 9i Application Server 1.0.2 deployments, especially internet-facing systems serving JSP content. Modern estates are unlikely to run this product, but forgotten legacy middleware, archived applications, and lab systems should be checked. Treat this as a legacy hygiene issue unless an exposed Oracle 9i server is found. It is not a standalone critical event, but path disclosure can reduce attacker effort during reconnaissance and should be removed from internet-facing environments. Mitigation focus: Inventory systems for Oracle 9i Application Server 1.0.2.; Review Oracle and CERT guidance linked in the source bundle.; Apply vendor-supported updates or configuration guidance where available..

Prepared

Jun 30, 2026, 16:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.