PT-2003-1142 · Peopletools · Application Messaging Gateway

Published 2003-02-07 · Updated 2008-09-10 · CVE-2002-1252

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Application Messaging Gateway for PeopleTools versions 8.1x through 8.18

Description The issue allows remote attackers to read arbitrary files via certain XML External Entities (XXE) fields in an HTTP POST request that is processed by the SimpleFileHandler handler.

Recommendations For versions 8.1x through 8.18, update to version 8.19 or later to resolve the issue.

Fix

Related Identifiers

CVE-2002-1252

Affected Products

Application Messaging Gateway

References · 4

• http://iss.net/security_center/static/10520.php · Vendor Advisory
• http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1252 · Security Note
• http://securityfocus.com/bid/6647 · Note