Detections
Analytics

Oracle E-Business Suite SQLNet Log File Disclosure

medium Web App Scanning Plugin ID 115319

Language:

Synopsis

Oracle E-Business Suite SQLNet Log File Disclosure

Description

Oracle E-Business Suite (EBS) exposes an Oracle Net (SQL*Net) log file, `sqlnet.log`, under a web-accessible `bin` directory (for example, `/OA_HTML/bin/sqlnet.log` or `/html/bin/sqlnet.log`). When this file is accessible without authentication, it discloses Oracle Net connection details such as the `DESCRIPTION=` connect descriptors and `USER=` entries, which reveal internal host names, service names, ports, and database account names.

An unauthenticated, remote attacker can retrieve this file to map the internal database topology and enumerate valid account and service names. This information can be leveraged to facilitate further targeted attacks against the Oracle E-Business Suite environment and its backing database services.

Solution

Restrict public access to the `sqlnet.log` file and its containing `bin` directory at the web server or reverse proxy layer, and apply Oracle's E-Business Suite security hardening guidance. Oracle Net log files should not be served from web-accessible locations; relocate them outside the document root where possible.

See Also

https://docs.oracle.com/cd/E26401_01/doc.122/e22952/toc.htm

Plugin Details

Severity: Medium

ID: 115319

Type: Check Based

Published: 7/28/2026

Updated: 7/28/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

Percentile: 0

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information