PT-2002-1463 · Microsoft · Asp.Net

Published 2002-06-11 · Updated 2016-10-18 · CVE-2002-0409

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASP.NET example code (affected versions not specified)

Description The issue allows remote attackers to view the orders of other users by modifying the OrderID parameter in the "orderdetails.aspx" page. This page was made available to Microsoft .NET developers as example code and is demonstrated on www.ibuyspystore.com.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0409

Affected Products

Asp.Net

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2002-0409 · Security Note
• http://marc.info/?l=bugtraq&m=101518860823788&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0409 · Note