Unscored severity · published Mar 19, 2006
CVE-2006-1257
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with…
–
CVSS
30.3%
EPSS
No
On KEV
Description
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
Exploitation
Is it being used?
Exploit prediction (EPSS)30.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Commerce Server · Microsoft
2002; 2002 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1257
msdn.microsoft.com
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp
securityreason.com
http://securityreason.com/securityalert/594
www.osvdb.org
http://www.osvdb.org/24121
www.securityfocus.com
http://www.securityfocus.com/archive/1/427974/100/0/threaded
Patch
http://www.securityfocus.com/bid/17134
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25330
More from Commerce Server
8.8
CVE-2012-1856
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
8.8
CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
–
CVE-2007-1201
Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to…
–
CVE-2002-0620
Buffer overflow in the Profile Service of Microsoft Commerce Server 2000 allows remote attackers to cause the server to fail or run arbitrary code in the LocalSystem security…
–
CVE-2002-0621
Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fail or run arbitrary…