CVE-2002-2073 Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr paramete...
MediumCVSS 4.3
EPSS 12.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft site server | = 3.0 | No fix listed |
| Microsoft site server commerce | = 3.0 | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
References
- 20020130 RFP2201: MS Site Server Evilness mailing-list
- siteserver-asp-css(8050) vdb-entry
- 3999 exploit vdb-entry vendor-advisory