PT-2002-1902 · New Atlanta · Servletexec Isapi

Published 2002-10-04 · Updated 2008-09-05 · CVE-2002-0892

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NewAtlanta ServletExec ISAPI version 4.1

Description: The default configuration of the software allows remote attackers to determine the path of the web root via a direct request to "com.newatlanta.servletexec.JSP10Servlet" without a filename, which leaks the pathname in an error message.

Recommendations: For NewAtlanta ServletExec ISAPI version 4.1, consider configuring the software to not leak the pathname in error messages, or restrict access to the com.newatlanta.servletexec.JSP10Servlet to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0892

Affected Products

Servletexec Isapi

References · 7

• 🔥 https://exploit-db.com/exploits/21469 · Exploit
• http://securityfocus.com/bid/4793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0892 · Security Note
• http://iss.net/security_center/static/9139.php · Vendor Advisory
• http://newatlanta.com/do/findFaq?faq_id=151 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0077.html · Note
• http://online.securityfocus.com/archive/1/273615 · Note