CVE-2002-0537

The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access the admin.html file to gain administrative privileges to SWS.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2002-04/0148.html	Exploit Patch Vendor Advisory
http://www.iss.net/security_center/static/8849.php	Vendor Advisory
http://www.securityfocus.com/bid/4503	Patch Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-04/0148.html	Exploit Patch Vendor Advisory
http://www.iss.net/security_center/static/8849.php	Vendor Advisory
http://www.securityfocus.com/bid/4503	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stepweb:sws:2.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2002-07-03 04:00

Updated : 2025-04-03 01:03

NVD link : CVE-2002-0537

Mitre link : CVE-2002-0537

CVE.ORG link : CVE-2002-0537

JSON object : View

Products Affected

stepweb

sws

CWE

NVD-CWE-Other

{"id": "CVE-2002-0537", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-07-03T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2002-04/0148.html", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8849.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4503", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2002-04/0148.html", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.iss.net/security_center/static/8849.php", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/4503", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, which allows remote attackers who can access the admin.html file to gain administrative privileges to SWS."}, {"lang": "es", "value": "El fichero admin.html en StepWeb Search Engine (SWS) 2.5 almacena contrase\u00f1as en enlaces a manager.pl, lo cual permite a atacantes remotos con acceso al fichero admin.html la obtenci\u00f3n de privilegios de administrador de SWS."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stepweb:sws:2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27B6F214-9F79-4BD4-8DE7-49F517ABAE39"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}