Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2002-0919: cspassword lets remote users edit site access file

CVE-2002-0919 · published 24 years ago

Summary

The cgiscript.net csPassword.cgi script lets anyone who is logged in change the .htaccess file, which controls who can view or edit parts of the website. By altering this file a user can give themselves higher privileges and access protected areas. Fix the problem by applying the vendor’s update or by limiting who can log in and regularly checking the .htaccess file for unauthorized changes.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cgiscript.net	cspassword	1.0 `cpe:2.3:a:cgiscript.net:cspassword:1.0:::::::*`

Original advisory text

CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title field of the edit page.

References

http://online.securityfocus.com/archive/1/274727
http://www.iss.net/security_center/static/9222.php Patch Vendor Advisory
http://www.securityfocus.com/bid/4888 Exploit Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Timeline

Published4 Oct 2002

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2002-0919 · NVD

Track software like this

Free during beta