CVE-2002-0563

no score yetEPSS 51%

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.

EPSS: 51% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2002-07-03
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

oracle:application_server
oracle:application_server_web_cache
oracle:oracle8i
oracle:oracle9i

References

http://marc.info/?l=bugtraq&m=101301813117562&w=2
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://securitytracker.com/id?1009167
http://www.appsecinc.com/Policy/PolicyCheck7024.html
http://www.cert.org/advisories/CA-2002-08.html

Check your stack JSON