CVE-2002-0236 Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe progra...
HighCVSS 7.5
EPSS 7.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lucent vitalanalysis | = 8.0 | No fix listed |
| lucent vitalanalysis | = 8.1 | No fix listed |
| lucent vitalanalysis | = 8.2 | No fix listed |
| lucent vitalevent | = 8.0 | No fix listed |
| lucent vitalevent | = 8.1 | No fix listed |
| lucent vitalevent | = 8.2 | No fix listed |
| lucent vitalhelp | = 8.0 | No fix listed |
| lucent vitalhelp | = 8.1 | No fix listed |
| lucent vitalhelp | = 8.2 | No fix listed |
| lucent vitalnet | = 8.0 | No fix listed |
| lucent vitalnet | = 8.1 | No fix listed |
| lucent vitalnet | = 8.2 | No fix listed |
| lucent vitalsuite | = 8.0 | No fix listed |
| lucent vitalsuite | = 8.1 | No fix listed |
| lucent vitalsuite | = 8.2 | No fix listed |
References
- 20020205 Published Report of Vulnerability in Lucent VitalSuite Software mailing-list
- vitalnet-unauth-access(7936) patch vdb-entry vendor-advisory
- 3784 exploit patch vdb-entry vendor-advisory