PT-2004-1945 · Vignette · Vignette Application Portal

Published 2004-11-19 · Updated 2017-07-11 · CVE-2004-0917

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vignette Application Portal (affected versions not specified)

Description: The issue concerns the default installation of the software, where the diagnostic utility is installed without authentication requirements. This allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to "/diag".

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0917

Affected Products

Vignette Application Portal

References · 5

• 🔥 http://atstake.com/research/advisories/2004/a092804-1.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0917 · Security Note
• http://securityfocus.com/bid/11267 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17530 · Note
• http://securitytracker.com/id?1011447 · Note