CVE-2001-0972 Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie (UserID 1...
HighCVSS 10.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie (UserID 1), i.e. "0888888."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| surf-net asp forum | <= 2.30 | No fix listed |
| surf-net asp forum | = 2.20 | No fix listed |
References
- 20010820 security problem in surf-net ASP Discussion Forum < 2.30 mailing-list
- 3210 patch vdb-entry vendor-advisory
- surfnet-asp-cookie-seq-predictable(7011) vdb-entry