CVE-2002-0563: Oracle 9i Application Server default config exposes services without authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network access to monitoring data and Java process control is serious, though the CVSS 2.0 score is only medium and no in-the-wild exploitation is documented.

What it is

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to reach sensitive services without authentication, including Dynamic Monitoring Services endpoints (dms0, dms/DMSDump, servlet/DMSDump, servlet/Spy, soap/servlet/Spy, dms/AggreSpy) and Oracle Java Process Manager endpoints (oprocmgr-status, oprocmgr-service). Because these services are reachable by default and unauthenticated, they expose monitoring data and Java process control to anyone who can reach the server.

Impact

An attacker gains unauthenticated read access to sensitive monitoring information and, via the Java Process Manager endpoints, the ability to control Java processes on the host. The CVSS 2.0 vector (AV:N/AC:L/Au:N/C:P/I:N/A:N) scores only partial confidentiality impact, so the process-control exposure is not reflected in that score.

Attack surface

Reachable over the network via HTTP requests to the listed DMS and oprocmgr paths; no authentication is required and no user interaction is indicated by the description or the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded; EPSS is high (0.51129, 98.88th percentile), and references carry Patch and Vendor Advisory tags, indicating fixes are available rather than documented in-the-wild exploitation.

What to do

• Apply the Oracle patch referenced in the vendor advisory and CERT CA-2002-08, or upgrade off the affected 1.0.2.x release.
• Disable or block access to the DMS and oprocmgr endpoints (dms0, dms/DMSDump, servlet/DMSDump, servlet/Spy, soap/servlet/Spy, dms/AggreSpy, oprocmgr-status, oprocmgr-service) at the web server or reverse proxy.
• Restrict network access to the application server so only trusted hosts can reach its HTTP ports.
• Verify that no default or anonymous access remains enabled for administrative and monitoring interfaces.
• Review the server for signs of prior unauthenticated access to these endpoints before remediation.

Detection

• Search web and proxy logs for requests to the listed paths, including dms0, DMSDump, Spy, AggreSpy, oprocmgr-status and oprocmgr-service.
• Alert on unauthenticated or anonymous requests to DMS and oprocmgr endpoints from unexpected source addresses.
• Monitor for repeated or scripted enumeration of these paths across hosts, which may indicate scanning.
• Audit Java process state and configuration changes on hosts running the affected application server for unexplained modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.