CVE-2002-1168
Published Nov 4, 2002
Last updated 16 years ago
Overview
- Description
- Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the Location as an HTTP header in the server response.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere_caching_proxy_server:3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5EFEB97-0E6F-4AFC-A9D6-F1E99FCAC242"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_caching_proxy_server:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57F14A9A-C642-4DA7-AB89-C036F1FC3286"
}
],
"operator": "OR"
}
]
}
]