Lucene search
HistoryOct 03, 2022 - 4:23 p.m.
CVE-2002-2389
theserver 1.74
web server
server.ini
access control
remote attackers
cleartext passwords
security vulnerability
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
73.1%
TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.
Affected configurations
Node
fastlink_softwarethe_serverMatch1.74
| CPE | Name | Operator | Version |
|---|---|---|---|
| fastlink_software:the_server | fastlink software the server | eq | 1.74 |
Related
openvas
openvas
TheServer clear text password
2005-11-03 00:00:00
TheServer clear text password
2005-11-03 00:00:00
nvd
nvd
CVE-2002-2389
2002-12-31 05:00:00
cvelist
cvelist
CVE-2002-2389
2022-10-03 16:23:49
nessus
nessus
TheServer server.ini Direct Request Plaintext Credentials Disclosure
2003-10-29 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
73.1%
Related for CVE-2002-2389