CVE-2002-0412

{"id": "CVE-2002-0412", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2002-08-12T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0056.html", "source": "cve@mitre.org"}, {"url": "http://listmanager.unipi.it/pipermail/ntop-dev/2002-February/000489.html", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=101854261030453&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=101856541322245&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=101908224609740&w=2", "source": "cve@mitre.org"}, {"url": "http://online.securityfocus.com/archive/1/259642", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://snapshot.ntop.org/", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8347.php", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/5307", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4225", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format strings to be injected into calls to the syslog function, via (1) an HTTP GET request, (2) a user name in HTTP authentication, or (3) a password in HTTP authentication."}, {"lang": "es", "value": "Vulnerabilidad de cadena de formato en la funci\u00f3n TraceEvent para ntop anteriores a la 2.1 permite a atacantes remotos la ejecuci\u00f3n de c\u00f3digo arbitrario haciendo que la cadena del formato forme parte de las llamadas a la funci\u00f3n syslog, mediante:\r\n\r\n una petici\u00f3n HTTP GET\r\n un nombre de usuario en la autenticaci\u00f3n HTTP\r\n una contrase\u00f1a en la autenticaci\u00f3n HTTP."}], "lastModified": "2016-10-18T02:20:14.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:luca_deri:ntop:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECBA05AB-4CB0-4B94-AFB6-D220F55D5E1D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}