PT-2003-2308 · Aprelium Technologies · Abyss Web Server

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1363

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Aprelium Technologies Abyss Web Server versions 1.1.2 and earlier

Description The issue concerns the remote web management interface of the affected software, which fails to log connection attempts to the web management port (9999). This oversight allows remote attackers to perform brute force attacks on the administration console without being detected.

Recommendations For versions 1.1.2 and earlier, consider implementing logging for connection attempts to the web management port as a temporary workaround until a patch is available. Restrict access to the administration console to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-1363

Affected Products

Abyss Web Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-1363 · Security Note
• http://iss.net/security_center/static/11310.php · Note
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0149.html · Note
• http://securityfocus.com/bid/6842 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1363 · Note