CVE-2007-0222

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-01-17 · updated 2026-06-16

Description

Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined. Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).

Affected products

Oracle Application Server: 10.1.3

References

http://secunia.com/advisories/23794
http://securitytracker.com/id?1017522
http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
http://www.securityfocus.com/archive/1/457105/100/0/threaded
http://www.securityfocus.com/archive/1/458657/100/0/threaded
http://www.securityfocus.com/bid/22027
http://www.securityfocus.com/bid/22083
http://secunia.com/advisories/23794
http://securitytracker.com/id?1017522
http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
http://www.securityfocus.com/archive/1/457105/100/0/threaded
http://www.securityfocus.com/archive/1/458657/100/0/threaded

Get alerted when CVE-2007-0222 or the next vulnerability affects your stack