PT-2003-2456 · Bajie · Bajie Java Http Server

Oliver Karow · Publicado 2003-12-31 · Atualizado 2008-09-05 · CVE-2003-1511

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bajie Java HTTP Server versions 0.95 through 0.95zxv4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the query string to "test.txt", the guestName parameter to the "custMsg" servlet, or the cookiename parameter to the "CookieExample" servlet.

Recommendations For Bajie Java HTTP Server versions 0.95 through 0.95zxv4, consider disabling the "custMsg" and "CookieExample" servlets until a patch is available. Restrict access to "test.txt" to minimize the risk of exploitation. Avoid using the guestName and cookiename parameters in the affected servlets until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2003-1511

Produtos afetados

Bajie Java Http Server

Referências · 7

• 🔥 http://securityreason.com/securityalert/3306 · Exploit
• 🔥 http://securityfocus.com/archive/1/341452 · Exploit
• 🔥 http://securityfocus.com/bid/8841 · Exploit
• 🔥 https://exploit-db.com/exploits/23257 · Exploit
• http://secunia.com/advisories/10023 · Aviso do Fabricante
• http://geocities.com/gzhangx/websrv/docs/security.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1511 · Nota de Segurança