Unscored severity · published Nov 29, 2002
CVE-2002-1316
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and…
–
CVSS
2%
EPSS
No
On KEV
Description
importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IW
Iplanet Web Server · Iplanet
4.1; 4.1_sp1; 4.1_sp2; 4.1_sp3; 4.1_sp4; 4.1_sp5; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1316
Exploit
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html
marc.info
http://marc.info/?l=bugtraq&m=103772308030269&w=2
sunsolve.sun.com
http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1
www.iss.net
http://www.iss.net/security_center/static/10693.php
www.ngsec.com
http://www.ngsec.com/docs/advisories/NGSEC-2002-4.txt
www.securityfocus.com
http://www.securityfocus.com/bid/6203
More from Iplanet Web Server
–
CVE-2002-1654
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher…
–
CVE-2002-1655
The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request
–
CVE-2002-1315
Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet…
–
CVE-2002-0845
Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding
–
CVE-2002-0686
Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the…