PT-2002-2793 · Microsoft · Site Server

Publicado 2002-12-31 · Atualizado 2016-10-18 · CVE-2002-2073

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Site Server version 3.0

Description: A cross-site scripting (XSS) issue exists in the default ASP pages, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the ctr parameter in "Default.asp" or the query string to "formslogin.asp".

Recommendations: For Microsoft Site Server version 3.0, consider disabling the Default.asp and formslogin.asp pages until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the ctr parameter in the Default.asp page and the query string in the formslogin.asp page until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2002-2073

Produtos afetados

Site Server

Referências · 5

• 🔥 https://exploit-db.com/exploits/21260 · Exploit
• 🔥 http://securityfocus.com/bid/3999 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2073 · Nota de Segurança
• http://iss.net/security_center/static/8050.php · Nota
• http://marc.info/?l=vulnwatch&m=101235440104716&w=2 · Nota