PT-2001-2101 · Valicert · Valicert Enterprise Validation Authority

Published 2001-12-04 · Updated 2024-02-14 · CVE-2001-0948

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1

Description A cross-site scripting issue allows remote attackers to execute arbitrary code or display false information by including HTML or script in the certificate's description, which is executed when the certificate is viewed.

Recommendations For versions 3.3 through 4.2.1, consider restricting the ability to include HTML or script in certificate descriptions until a fix is available. As a temporary workaround, avoid viewing certificates that may contain malicious code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-0948

Affected Products

Valicert Enterprise Validation Authority

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0948 · Security Note
• http://securityfocus.com/bid/3619 · Vendor Advisory
• http://valicert.com/support/security_advisory_eva.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7650 · Note
• http://marc.info/?l=bugtraq&m=100749428517090&w=2 · Note