Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2002-1541: BadBlue 1.7 lets remote users skip password protection

CVE-2002-1541 · published 23 years ago

Summary

The BadBlue version 1.7 web interface can be tricked by sending a specially crafted URL that includes an extra slash. This lets someone outside your network view or download files that should be protected by a password. Update BadBlue to a newer version or apply the vendor's recommended configuration change to stop the bypass.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
working_resources_inc.	badblue	1.7.0 `cpe:2.3:a:working_resources_inc.:badblue:1.7.0:::::::*`

Original advisory text

BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash).

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0041.html Vendor Advisory
http://www.iss.net/security_center/static/10466.php Vendor Advisory
http://www.securityfocus.com/bid/6044 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Timeline

Published31 Mar 2003

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2002-1541 · NVD

Track software like this

Free during beta