FKIE_CVE-2002-0310

Vulnerability from fkie_nvd - Published: 2002-05-31 04:00 - Updated: 2026-06-16 21:57
Severity
Summary
Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3) alwi3845/wtest3452, or (4) testweb2/wtest4879.
References
cve@mitre.orghttp://marc.info/?l=bugtraq&m=101432236729631&w=2
cve@mitre.orghttp://www.securityfocus.com/bid/4156
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/8255
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=101432236729631&w=2
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/4156
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/8255
Impacted products
Vendor Product Version
netwin webnews 1.1h
netwin webnews 1.1i
netwin webnews 1.1j
netwin webnews 1.1k
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netwin:webnews:1.1h:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F07C676-4908-4922-9539-A2280404F914",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netwin:webnews:1.1i:*:*:*:*:*:*:*",
              "matchCriteriaId": "30F011C3-EC7F-4C6F-96A1-150BB3E4665C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netwin:webnews:1.1j:*:*:*:*:*:*:*",
              "matchCriteriaId": "12C93175-178C-4F49-B613-80D9EF0F4ADB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netwin:webnews:1.1k:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E0B0D31-69A2-464C-8A99-47C379AD8319",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3) alwi3845/wtest3452, or (4) testweb2/wtest4879."
    },
    {
      "lang": "es",
      "value": "El programa CGI Netwin WebNews 1.1k incluye por defecto ciertos nombres de usuarios y contrase\u00f1as en texto claro que no pueden ser borrados por el administrador, lo que permite a atacantes remotos ganar privilegios mediante las combianciones de nombres de usuario/contrase\u00f1a: testweb/newtestalwn3854/imaptestalwi3845/wtest3452, o testweb2/wtest4879."
    }
  ],
  "id": "CVE-2002-0310",
  "lastModified": "2026-06-16T21:57:11.513",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-05-31T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=101432236729631\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/4156"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=101432236729631\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/4156"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8255"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.