PT-2003-1263 · Surfcontrol · Surfcontrol Superscout Email Filter

Published 2003-03-31 · Updated 2008-09-05 · CVE-2002-1530

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SurfControl SuperScout Email Filter (affected versions not specified)

Description The issue concerns the administrative web interface, specifically the STEMWADM component of SurfControl SuperScout Email Filter. It allows unauthorized access to usernames and plaintext passwords through a request to the "userlist.asp" program. This program includes passwords in a user editing form, thus exposing sensitive information.

Recommendations For SurfControl SuperScout Email Filter, consider restricting access to the userlist.asp program to minimize the risk of exploitation. As a temporary workaround, limit the use of the administrative web interface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2002-1530

Affected Products

Surfcontrol Superscout Email Filter

References · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0137.html · Exploit
• 🔥 http://securityfocus.com/bid/5929 · Exploit
• 🔥 https://exploit-db.com/exploits/21925 · Exploit
• http://iss.net/security_center/static/10320.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1530 · Security Note