CVE-2001-1217: Oracle 9i Application Server PL/SQL module directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated information disclosure with a high EPSS percentile, though impact is limited to confidentiality and no KEV listing or confirmed exploit is present.

What it is

The PL/SQL Apache module in Oracle 9i Application Server is vulnerable to directory traversal, allowing a remote attacker to read files outside the intended web root. The flaw is triggered by a double-encoded URL containing dot-dot sequences, which bypasses path filtering. It matters because sensitive files on the server can be exposed without authentication.

Impact

An attacker gains read access to sensitive information on the server, such as configuration or application files reachable by the web process. No write or code execution is described in the record.

Attack surface

Reachable remotely over the network through the PL/SQL Apache module via a crafted double-encoded URL. The CVSS vector indicates no authentication (Au:N) and no user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.54383, 98.96th percentile), and references are vendor and third-party advisories with patch tags, but no public exploit code is confirmed in the record.

What to do

• Apply the Oracle patch referenced in the vendor advisory (modplsql.pdf) and CERT/CC advisory VU#758483.
• Disable or restrict the PL/SQL Apache module if it is not required.
• Normalize and reject double-encoded and dot-dot sequences at the web server or reverse proxy layer.
• Run the web service with least privilege and restrict filesystem access to only required directories.
• Monitor vendor advisories for updated guidance since the record is old and product version detail is absent.

Detection

• Inspect web server and PL/SQL module logs for URLs containing double-encoded dot-dot sequences (e.g., %252e%252e) or repeated traversal patterns.
• Alert on requests to the PL/SQL module that return files outside expected web content paths.
• Baseline normal PL/SQL module request patterns and flag anomalous path traversal attempts.
• Review file access logs for reads of sensitive files by the web service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.