CVE-2002-2073 Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2002-2073?
CVE-2002-2073 is a medium-severity vulnerability in Microsoft Windows Nt, published on 14 Jul 2005.
Official description
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
Which versions are affected by CVE-2002-2073?
It affects 3 products.
Products include Microsoft Site Server, Microsoft Site Server Commerce, Microsoft Windows Nt.
How do I fix CVE-2002-2073?
No fix has been published for CVE-2002-2073 yet. Limit exposure of the affected software until one is available.
Is CVE-2002-2073 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-2073 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Windows Nt
- CVE-2002-1769 Hardcoded credentials in n/a
- CVE-1999-1246 Information disclosure in n/a
- CVE-2000-0161 SQL injection in n/a
- CVE-1999-0360 MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely.
- CVE-2002-2081 Denial of service in n/a
Sources
Also known as GHSA-33j6-jcch-j278.