PT-2002-1930 · Cgiscript.Net · Cspassword.Cgi

Published 2002-08-31 · Updated 2008-09-10 · CVE-2002-0920

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: CGIScript.net csPassword.cgi (affected versions not specified)

Description: The issue concerns the storage of sensitive data in a temporary file. Specifically, usernames and unencrypted passwords are stored in the password.cgi.tmp temporary file while data is being modified. This could potentially allow local users, and possibly remote attackers, to gain privileges by accessing the file before it has been processed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0920

Affected Products

Cspassword.Cgi

References · 4

• http://iss.net/security_center/static/9223.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0920 · Security Note
• http://online.securityfocus.com/archive/1/274727 · Note
• http://securityfocus.com/bid/4889 · Note