VulnerabilityModified
CVE-2002-2389
TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.
MEDIUM 5.0EPSS 1.90%
Does this matter?
Lower severity and a low EPSS score (1.90%). Track it; it rarely justifies an emergency change on its own.
Description
TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.90% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- fastlink software/the server
- Source
- cve@mitre.org
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html
- http://securitytracker.com/id?1004799
- http://www.iss.net/security_center/static/9624.php
- http://www.securityfocus.com/archive/1/295325
- http://www.securityfocus.com/bid/5250
- http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html
- http://securitytracker.com/id?1004799
- http://www.iss.net/security_center/static/9624.php
- http://www.securityfocus.com/archive/1/295325
- http://www.securityfocus.com/bid/5250
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.