Vignette · Vignette Storyserver · CVE-2003-0399
Name of the Vulnerable Software and Affected Versions:
Vignette StoryServer versions 4 and 5
Vignette V/5
Description:
The issue allows remote attackers to perform unauthorized SELECT queries. This can be achieved by setting the `vgn creds` cookie to an arbitrary value and directly accessing the save template.
Recommendations:
For Vignette StoryServer versions 4 and 5, consider restricting access to the save template to prevent unauthorized SELECT queries.
For Vignette V/5, restrict access to the save template to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.