PT-2004-2420 · 04Webserver · 04Webserver

Jérôme Athias · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1512

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 04WebServer version 1.42

Description A cross-site scripting (XSS) issue exists due to the failure to properly quote script code in the URL within the resulting default error page of Response default.html. This allows remote attackers to execute arbitrary web script or HTML.

Recommendations For version 1.42, ensure that script code in URLs is properly quoted in the default error page to prevent XSS attacks. As a temporary workaround, consider restricting access to the default error page until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2004-1512

Affected Products

04Webserver

References · 8

• 🔥 http://securityfocus.com/bid/11652 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1512 · Security Note
• http://secunia.com/advisories/13159 · Vendor Advisory
• http://security.org.sg/vuln/04webserver142.html · Patch
• http://marc.info/?l=bugtraq&m=110012542615484&w=2 · Note
• http://soft3304.net/04WebServer/Security.html · Note
• http://marc.info/?l=bugtraq&m=110054395311823&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18033 · Note