PT-2002-2793 · Microsoft · Site Server

Published 2002-12-31 · Updated 2016-10-18 · CVE-2002-2073

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Site Server version 3.0

Description: A cross-site scripting (XSS) issue exists in the default ASP pages, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the ctr parameter in "Default.asp" or the query string to "formslogin.asp".

Recommendations: For Microsoft Site Server version 3.0, consider disabling the Default.asp and formslogin.asp pages until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the ctr parameter in the Default.asp page and the query string in the formslogin.asp page until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-2073

Affected Products

Site Server

References · 5

• 🔥 https://exploit-db.com/exploits/21260 · Exploit
• 🔥 http://securityfocus.com/bid/3999 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2073 · Security Note
• http://iss.net/security_center/static/8050.php · Note
• http://marc.info/?l=vulnwatch&m=101235440104716&w=2 · Note