PT-2002-1902 · New Atlanta · Servletexec Isapi

Publicado 2002-10-04 · Atualizado 2008-09-05 · CVE-2002-0892

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NewAtlanta ServletExec ISAPI version 4.1

Description: The default configuration of the software allows remote attackers to determine the path of the web root via a direct request to "com.newatlanta.servletexec.JSP10Servlet" without a filename, which leaks the pathname in an error message.

Recommendations: For NewAtlanta ServletExec ISAPI version 4.1, consider configuring the software to not leak the pathname in error messages, or restrict access to the com.newatlanta.servletexec.JSP10Servlet to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-0892

Produtos afetados

Servletexec Isapi

Referências · 7

• 🔥 https://exploit-db.com/exploits/21469 · Exploit
• http://securityfocus.com/bid/4793 · Aviso do Fabricante
• http://newatlanta.com/do/findFaq?faq_id=151 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0077.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0892 · Nota de Segurança
• http://iss.net/security_center/static/9139.php · Aviso do Fabricante
• http://online.securityfocus.com/archive/1/273615 · Nota