CVE-2002-1484 DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that spe...
CriticalCVSS 9.8
EPSS 13.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens db4web | = 3.4 | No fix listed |
| Siemens db4web | = 3.6 | No fix listed |
References
- 20020917 Advisory: TCP-Connection risk in DB4Web broken-link mailing-list vendor-advisory
- 20020919 Advisory: TCP-Connection risk in DB4Web broken-link mailing-list vendor-advisory
- db4web-tcp-portscan(10136) broken-link exploit vdb-entry vendor-advisory
- 5725 broken-link exploit patch third-party-advisory vdb-entry vendor-advisory