CVE-2007-0222 json
Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to rea…
published 2007-01-17 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0224
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.5%
- EPSS 13.5% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined. Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).
Patch / fix
- securityfocus.com/bid/22027 patch
- secunia.com/advisories/23794 advisory
Exploit prediction
13.46% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
secunia.com
/advisories/23794
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/22027
vdb-entry, patch
-
securityfocus.com
/archive/1/458657/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/457105/100/0/threaded
mailing-list
-
securityfocus.com
/bid/22083
vdb-entry
- oracle.com /technetwork/topics/security/cpujan2007-101493.html
-
securitytracker.com
/id?1017522
vdb-entry
Sources
- CVE List CVE-2007-0222
- NVD CVE-2007-0222
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.