PT-2009-1129 · Goahead · Goahead Web Server

Published 2009-02-06 · Updated 2009-07-23 · CVE-2002-2427

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoAhead WebServer versions prior to 2.1.1

Description The security handler in the web server allows remote attackers to bypass authentication and obtain access to protected web content via an extra slash in a URL.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2002-2427

Affected Products

Goahead Web Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2427 · Security Note
• http://data.goahead.com/Software/Webserver/2.1.8/release.htm#security-features-can-be-bypassed-by-adding-an-extra-slash-in-the-url-bug01518 · Vendor Advisory
• http://kb.cert.org/vuls/id/124059 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2427 · Note