CVE-2002-1654 — Improper Control of Interaction Frequency in WEB Server

3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.9%
top 16.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Iplanet WEB ServerNetscape Enterprise Server
Timeline
PublishedDec 31
Latest updateApr 30

Description

iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDnetscape/enterprise_server8 versions+7
▶NVDiplanet/iplanet_web_server6.0, enterprise_4.0, enterprise_4.1+2

Patches

Patch: lists.virus.org ↗Patch: securitytracker.com ↗Patch: www.kb.cert.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-vghm-g8g9-w459: iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4↗2022-04-30
▶
CVEList
CVE-2002-1654: iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4↗2005-03-28
▶
CVE-2002-1654 — Iplanet WEB Server vulnerability | cvebase