CVE-2002-2389 - Vulnerability Details - OpenCVE

TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.004.

Key SSVC decision points have not yet been added.

Vendors	Products
Fastlink Software	The Server

Configuration 1 [-]

cpe:2.3:a:fastlink_software:the_server:1.74:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2002-2367	TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html
http://securitytracker.com/id?1004799
http://www.iss.net/security_center/static/9624.php
http://www.securityfocus.com/archive/1/295325
http://www.securityfocus.com/bid/5250

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-31T16:00:00Z

Updated: 2024-09-17T02:36:32.688Z

Reserved: 2007-10-31T00:00:00Z

Link: CVE-2002-2389

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2002-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2002-2389

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-10-31T16:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/5250"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-2389", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "refsource": "XF", "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "refsource": "BID", "url": "http://www.securityfocus.com/bid/5250"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T03:59:11.982Z"}, "title": "CVE Program Container", "references": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/5250"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-2389", "datePublished": "2007-10-31T16:00:00Z", "dateReserved": "2007-10-31T00:00:00Z", "dateUpdated": "2024-09-17T02:36:32.688Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlink_software:the_server:1.74:*:*:*:*:*:*:*", "matchCriteriaId": "1B1A146D-8E82-4D3A-9E1D-B68717375FFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}], "id": "CVE-2002-2389", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2002-12-31T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1004799"}, {"source": "cve@mitre.org", "url": "http://www.iss.net/security_center/static/9624.php"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/295325"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/5250"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1004799"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.iss.net/security_center/static/9624.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/295325"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/5250"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}