CVE-2002-1316
published 2002-11-29CVE-2002-1316: importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in…
PriorityP426medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.04%
78.7th percentile
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| iplanet | iplanet_web_server | — | — |
| sun | one_web_server | <= 4.1 | — |
| sun | one_web_server | <= 6.0 | — |
| sun | one_web_server | — | — |
| sun | one_web_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gx3x-pcq5-hjcw: importInfo in the Admin Server for iPlanet WebServer 4
ghsa_unreviewed·2022-04-30·CVSS 6.8
CVE-2002-1316 [MEDIUM] GHSA-gx3x-pcq5-hjcw: importInfo in the Admin Server for iPlanet WebServer 4
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
GHSA
GHSA-6j9f-c956-rhqf: Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4
ghsa_unreviewed·2022-04-30·CVSS 6.8
CVE-2002-1315 [MEDIUM] GHSA-6j9f-c956-rhqf: Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4
Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs, and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316).
GHSA
GHSA-3cq9-wp9j-2w5v: Sun ONE (aka iPlanet) Web Server 4
ghsa_unreviewed·2022-04-29·CVSS 6.8
CVE-2003-1577 [MEDIUM] CWE-79 GHSA-3cq9-wp9j-2w5v: Sun ONE (aka iPlanet) Web Server 4
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.htmlhttp://marc.info/?l=bugtraq&m=103772308030269&w=2http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1http://www.iss.net/security_center/static/10693.phphttp://www.ngsec.com/docs/advisories/NGSEC-2002-4.txthttp://www.securityfocus.com/bid/6203http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.htmlhttp://marc.info/?l=bugtraq&m=103772308030269&w=2http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1http://www.iss.net/security_center/static/10693.phphttp://www.ngsec.com/docs/advisories/NGSEC-2002-4.txthttp://www.securityfocus.com/bid/6203
2002-11-29
Published