PT-2002-2507 · Zeus · Zeus Web Server

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1785

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zeus Web Server versions 4.0 through 4.1r2

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the section parameter to "index.fcgi" API endpoint.

Recommendations For Zeus Web Server versions 4.0 through 4.1r2, avoid using the section parameter in the "index.fcgi" API endpoint until a fix is available. Consider restricting access to the index.fcgi endpoint to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1785

Affected Products

Zeus Web Server

References · 7

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-11/0104.html · Exploit
• 🔥 https://exploit-db.com/exploits/22000 · Exploit
• 🔥 http://securityfocus.com/bid/6144 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/302961 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1785 · Security Note
• http://iss.net/security_center/static/10567.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1785 · Note