« Volver al listado

CVE-2002-0385

Estado: ModificadaMedia (5)—

Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Vignette — StoryserverVignette — Vignette

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2002-0385",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-06-01T04:00:00.000",
  "references": [
    {
      "url": "http://www.atstake.com/research/advisories/2003/a040703-1.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/7296",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11725",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.atstake.com/research/advisories/2003/a040703-1.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/7296",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11725",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '\"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output."
    },
    {
      "lang": "es",
      "value": "Vignette Story Server 4.1 and 6.0 permite a atacantes remotos obtener información sensible mediante una petición conteniendo un número grande de caractéres \"comillas dobles\" y símbolos \"mayor que\", lo que hace que el intérprete se caiga y muestre datos de la pila en la salida."
    }
  ],
  "lastModified": "2026-06-16T21:57:20.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vignette:storyserver:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A69859D5-F4AF-4239-ADB2-5AB3F6A3F25F"
            },
            {
              "criteria": "cpe:2.3:a:vignette:storyserver:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC0BDA9F-F594-43E3-8514-A5D5FA6CBF41"
            },
            {
              "criteria": "cpe:2.3:a:vignette:vignette:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D1E15D6-2CA5-419C-80AD-9E8FE6A054C3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}