Strix
26.1K

CVE-2002-0286

UnknownEPSS 1.57%

Last modified

CVE-2002-0286 is a vulnerability of currently unknown severity. The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user.. EPSS estimates a 1.57% chance of exploitation in the next 30 days.

Description

The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user.

Metrics

EPSS Probability
1.57%

72.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
SitenewsSitenews0.01_beta
SitenewsSitenews0.02_beta
SitenewsSitenews0.03_beta
SitenewsSitenews0.04_beta
SitenewsSitenews0.05_beta
SitenewsSitenews0.06_beta
SitenewsSitenews0.07_beta
SitenewsSitenews0.08_beta
SitenewsSitenews0.09_beta
SitenewsSitenews0.10_beta
SitenewsSitenews0.11_beta

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2002-0286?
The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user.
How severe is CVE-2002-0286?
Severity scoring for CVE-2002-0286 is pending analysis. The EPSS model estimates a 1.57% probability of exploitation in the next 30 days.
How do I fix CVE-2002-0286?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2002-0286?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST