CVE-2002-1470 SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-readable sc_serv.log....
LowCVSS 2.1
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-readable sc_serv.log file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nullsoft shoutcast server | = 1.8.9 | No fix listed |
References
- 20020806 Fate Research Labs Advisory: Retrieve SHOUTcast Admin Password Through GET / exploit mailing-list patch vendor-advisory
- shoutcast-scservlog-world-readable(9775) vdb-entry vendor-advisory
- 5414 patch vdb-entry vendor-advisory