CVE-2003-0628

PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=106874146204158&w=2
http://marc.info/?l=bugtraq&m=106874146204158&w=2

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:peoplesoft:peopletools:8.4:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.10:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.11:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.12:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.13:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.14:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.15:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.16:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.17:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.18:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.19:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.20:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.40:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.41:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.42:::::::*
	cpe:2.3:a:peoplesoft:peopletools:8.43:::::::*

History

20 Nov 2024, 23:45

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=bugtraq&m=106874146204158&w=2 -~~	() http://marc.info/?l=bugtraq&m=106874146204158&w=2 -

Information

Published : 2003-12-15 05:00

Updated : 2025-04-03 01:03

NVD link : CVE-2003-0628

Mitre link : CVE-2003-0628

CVE.ORG link : CVE-2003-0628

JSON object : View

Products Affected

peoplesoft

peopletools

CWE

NVD-CWE-Other

{"id": "CVE-2003-0628", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2003-12-15T05:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=106874146204158&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=106874146204158&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value."}, {"lang": "es", "value": "PeopleSoft Gateway Administration servlet (gateway.administration) en PeopleTools 8.43 y anteriores permite a atacantes remotos obtener las rutas completas de ficheros incluidos en el servidor (server-side includes) mediante una petici\u00f3n HTTP con un valor no v\u00e1lido."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70B618A8-48AF-4193-BCD8-7B0F24923860"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE31EA39-F6EE-4FC6-A64F-74E1364A84C3"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5611ED3-9504-469C-A33D-D6AB31971BE5"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "030FF50A-1D1D-4D7D-964E-2F2CA3980C27"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D113AFE-BEF6-4557-B814-073F56912667"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9ADCBDC1-C291-4978-95CC-2955AF9F0149"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "623DDE5E-20CF-4002-A532-E1B0171FF0C5"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55820FF1-2A48-4699-8C90-90CBC0C2D6A4"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAD1CF68-901D-4366-81F1-20E561BEB405"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B7B6AF6-2C2B-4186-911A-63D7CCE34E79"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A132448-0960-4878-9947-8F0B07C2E516"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15C45E32-CDEB-4AB2-B3BB-1F399F98E0B7"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "805FBA0A-0B52-4E61-A45C-E2C9AD48E555"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.41:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F94A7F77-D984-49BD-B59E-EBBC91C56C66"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.42:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD78CC13-C007-4AB1-912E-16B37D1D55CD"}, {"criteria": "cpe:2.3:a:peoplesoft:peopletools:8.43:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECCB21D3-4FCB-4F0E-8430-B587512D04ED"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}