Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

WEBsweeper may let malicious scripts run on filtered pages

CVE-2001-1157 · published 25 years ago
Summary

The WEBsweeper 4.0 and 4.02 web‑filter can be fooled into allowing JavaScript code to pass through its HTML checks. An attacker can craft a page with a hidden or specially encoded <script> tag, causing the filter to miss it. Update to a version that correctly blocks script tags or apply additional content‑security controls to prevent unwanted code from reaching users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
baltimore_technologies websweeper 4.0
4.02
cpe:2.3:o:baltimore_technologies:websweeper:4.0:*:*:*:*:*:*:*
Original advisory text
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or ...
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published12 Aug 2001
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2001-1157 · NVD
Track software like this
Free during beta