Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2002-1042

4 documents4 sources
Severity
5.0MEDIUM
EPSS
10.6%
top 6.73%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Netscape Enterprise ServerSUN Iplanet WEB ServerSUN ONE Application Server+1 more
Timeline
PublishedOct 4
Latest updateApr 30

Description

Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

Patches

Patch: www.iss.net ↗Patch: www.securityfocus.com ↗Patch: www.iss.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-jmq5-vh92-gvhq: Directory traversal vulnerability in search engine for iPlanet web server 6↗2022-04-30
▶
CVEList
CVE-2002-1042: Directory traversal vulnerability in search engine for iPlanet web server 6↗2002-08-31
▶

💥Exploits & PoCs

1
Exploit-DB
iPlanet Web Server 4.1 - Search Component File Disclosure↗2002-07-09
▶