PT-2003-1596 · Vignette · Vignette V/6+1

Ramon Pinuaga Cascales · Published 2003-06-11 · Updated 2016-10-18 · CVE-2003-0405

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Vignette StoryServer version 5 Vignette V/6

Description: The issue allows remote attackers to execute arbitrary TCL code. This can be achieved via an HTTP query or cookie that is processed in the NEEDS command, or an HTTP Referrer that is processed in the VALID PATHS command.

Recommendations: For Vignette StoryServer version 5, consider restricting access to the NEEDS command and validating all HTTP queries and cookies to prevent arbitrary TCL code execution. For Vignette V/6, restrict access to the VALID PATHS command and validate all HTTP Referrers to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-0405

Affected Products

Vignette Storyserver

Vignette V/6

References · 6

• http://securityfocus.com/bid/7690 · Vendor Advisory
• http://iss.net/security_center/static/12070.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0405 · Security Note
• http://securityfocus.com/bid/7692 · Vendor Advisory
• http://s21sec.com/es/avisos/s21sec-024-en.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=105405922826197&w=2 · Note