PT-2002-1952 · Metacart · Metacart2

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-0943

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: MetaCart2 (affected versions not specified)

Description: The issue allows remote attackers to obtain sensitive information, including passwords and credit card numbers, by directly requesting the metacart.mdb file. This is because the user database is stored under the web document root without access controls.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0943

Affected Products

Metacart2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-0943 · Security Note
• http://iss.net/security_center/static/9393.php · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-06/0200.html · Note
• http://securityfocus.com/bid/5042 · Note