Unscored severity · published Nov 29, 2002
CVE-2002-1315
Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs, and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316).
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IW
Iplanet Web Server · Iplanet
4.1; 4.1_sp1; 4.1_sp2; 4.1_sp3; 4.1_sp4; 4.1_sp5; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1315
Exploit
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html
marc.info
http://marc.info/?l=bugtraq&m=103772308030269&w=2
sunsolve.sun.com
http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1
Exploit
http://www.iss.net/security_center/static/10692.php
Exploit
http://www.ngsec.com/docs/advisories/NGSEC-2002-4.txt
Exploit
http://www.securityfocus.com/bid/6202
More from Iplanet Web Server
–
CVE-2002-1654
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher…
–
CVE-2002-1655
The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request
–
CVE-2002-1316
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and…
–
CVE-2002-0845
Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding
–
CVE-2002-0686
Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the…