PT-2002-2256 · Oracle · Iplanet Web Server

Published 2002-11-21 · Updated 2016-10-18 · CVE-2002-1315

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: iPlanet WebServer versions 4.x up to SP11

Description: A cross-site scripting (XSS) issue allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs. This could potentially be used to escalate privileges when combined with another issue.

Recommendations: For iPlanet WebServer versions 4.x up to SP11, consider disabling access to error logs to minimize the risk of exploitation until a fix is available. Restrict administrative access to the server to reduce the potential impact of this issue.

Exploit

Fix

Related Identifiers

CVE-2002-1315

Affected Products

Iplanet Web Server

References · 7

• 🔥 http://securityfocus.com/bid/6202 · Exploit
• 🔥 http://iss.net/security_center/static/10692.php · Exploit
• 🔥 http://ngsec.com/docs/advisories/NGSEC-2002-4.txt · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1315 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103772308030269&w=2 · Note