PT-2003-1590 · Vignette · Vignette Storyserver+1

Ramon Pinuaga Cascales · Published 2003-06-11 · Updated 2016-10-18 · CVE-2003-0399

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Vignette StoryServer versions 4 and 5 Vignette V/5

Description: The issue allows remote attackers to perform unauthorized SELECT queries. This can be achieved by setting the vgn creds cookie to an arbitrary value and directly accessing the save template.

Recommendations: For Vignette StoryServer versions 4 and 5, consider restricting access to the save template to prevent unauthorized SELECT queries. For Vignette V/5, restrict access to the save template to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0399

Affected Products

Vignette Storyserver

Vignette V/5

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-0399 · Security Note
• http://iss.net/security_center/static/12076.php · Vendor Advisory
• http://s21sec.com/es/avisos/s21sec-017-en.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=105405874325673&w=2 · Note
• http://securityfocus.com/bid/7683 · Note