CVE-2002-2389 - Vulnerability Details - OpenCVE

TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fastlink Software	The Server

Configuration 1 [-]

cpe:2.3:a:fastlink_software:the_server:1.74:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html
http://securitytracker.com/id?1004799
http://www.iss.net/security_center/static/9624.php
http://www.securityfocus.com/archive/1/295325
http://www.securityfocus.com/bid/5250

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-31T16:00:00Z

Updated: 2024-09-17T02:36:32.688Z

Reserved: 2007-10-31T00:00:00Z

Link: CVE-2002-2389

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2002-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2002-2389

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-10-31T16:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/5250"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-2389", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "refsource": "XF", "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "refsource": "BID", "url": "http://www.securityfocus.com/bid/5250"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T03:59:11.982Z"}, "title": "CVE Program Container", "references": [{"name": "fastlink-theserver-plaintext-passwords(9624)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "http://www.iss.net/security_center/static/9624.php"}, {"name": "1004799", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1004799"}, {"name": "20020717 TheServer cleartext password sillyness.", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"name": "20021014 TheServer log file access password in cleartext w/vendor resolution.", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/295325"}, {"name": "5250", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/5250"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-2389", "datePublished": "2007-10-31T16:00:00Z", "dateReserved": "2007-10-31T00:00:00Z", "dateUpdated": "2024-09-17T02:36:32.688Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlink_software:the_server:1.74:*:*:*:*:*:*:*", "matchCriteriaId": "1B1A146D-8E82-4D3A-9E1D-B68717375FFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext passwords and gain access to server log files."}], "id": "CVE-2002-2389", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2002-12-31T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1004799"}, {"source": "cve@mitre.org", "url": "http://www.iss.net/security_center/static/9624.php"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/295325"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/5250"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-July/000138.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1004799"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.iss.net/security_center/static/9624.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/295325"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/5250"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}