Vulnerability-Lookup

FKIE_CVE-2003-0950

Vulnerability from fkie_nvd - Published: 2003-12-15 05:00 - Updated: 2025-04-03 01:03

Severity ?

Summary

PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file.

References

URL	Tags
cve@mitre.org	http://www.securityfocus.com/bid/9041	Vendor Advisory
cve@mitre.org	http://xforce.iss.net/xforce/alerts/id/157
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/12805
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/9041	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://xforce.iss.net/xforce/alerts/id/157
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/12805

Impacted products

Vendor	Product	Version
peoplesoft	peopletools	8.4
peoplesoft	peopletools	8.10
peoplesoft	peopletools	8.11
peoplesoft	peopletools	8.12
peoplesoft	peopletools	8.13
peoplesoft	peopletools	8.14
peoplesoft	peopletools	8.15
peoplesoft	peopletools	8.16
peoplesoft	peopletools	8.17
peoplesoft	peopletools	8.18
peoplesoft	peopletools	8.19
peoplesoft	peopletools	8.20
peoplesoft	peopletools	8.40
peoplesoft	peopletools	8.41
peoplesoft	peopletools	8.42
peoplesoft	peopletools	8.43

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "70B618A8-48AF-4193-BCD8-7B0F24923860",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE31EA39-F6EE-4FC6-A64F-74E1364A84C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5611ED3-9504-469C-A33D-D6AB31971BE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "030FF50A-1D1D-4D7D-964E-2F2CA3980C27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D113AFE-BEF6-4557-B814-073F56912667",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "9ADCBDC1-C291-4978-95CC-2955AF9F0149",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "623DDE5E-20CF-4002-A532-E1B0171FF0C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "55820FF1-2A48-4699-8C90-90CBC0C2D6A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAD1CF68-901D-4366-81F1-20E561BEB405",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B7B6AF6-2C2B-4186-911A-63D7CCE34E79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A132448-0960-4878-9947-8F0B07C2E516",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "15C45E32-CDEB-4AB2-B3BB-1F399F98E0B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "805FBA0A-0B52-4E61-A45C-E2C9AD48E555",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.41:*:*:*:*:*:*:*",
              "matchCriteriaId": "F94A7F77-D984-49BD-B59E-EBBC91C56C66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.42:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD78CC13-C007-4AB1-912E-16B37D1D55CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peoplesoft:peopletools:8.43:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECCB21D3-4FCB-4F0E-8430-B587512D04ED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file."
    },
    {
      "lang": "es",
      "value": "PeopleSoft, PeopleTools, 8.1x, 8.2x, y 8.4x permite que atacantes remotos ejecuten comando arbitrarios subiendo un fichero al Servlet IClient, adivinando el nombre del directorio usado para el almacenar el fichero (no suficientemente aleatorio) y por tanto accediendo al fichero."
    }
  ],
  "id": "CVE-2003-0950",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-12-15T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/9041"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://xforce.iss.net/xforce/alerts/id/157"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12805"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/9041"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://xforce.iss.net/xforce/alerts/id/157"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12805"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2003-0950 (GCVE-0-2003-0950)

Vulnerability from cvelistv5 – Published: 2003-11-18 05:00 – Updated: 2024-08-08 02:12

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://xforce.iss.net/xforce/alerts/id/157	third-party-advisoryx_refsource_ISS
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://www.securityfocus.com/bid/9041	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:12:35.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20031112 IClient Servlet Remote Command Execution Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_ISS",
              "x_transferred"
            ],
            "url": "http://xforce.iss.net/xforce/alerts/id/157"
          },
          {
            "name": "peoplesoft-iclientservlet-file-upload(12805)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12805"
          },
          {
            "name": "9041",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/9041"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-11-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20031112 IClient Servlet Remote Command Execution Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_ISS"
          ],
          "url": "http://xforce.iss.net/xforce/alerts/id/157"
        },
        {
          "name": "peoplesoft-iclientservlet-file-upload(12805)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12805"
        },
        {
          "name": "9041",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/9041"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0950",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20031112 IClient Servlet Remote Command Execution Vulnerability",
              "refsource": "ISS",
              "url": "http://xforce.iss.net/xforce/alerts/id/157"
            },
            {
              "name": "peoplesoft-iclientservlet-file-upload(12805)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12805"
            },
            {
              "name": "9041",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/9041"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0950",
    "datePublished": "2003-11-18T05:00:00",
    "dateReserved": "2003-11-14T00:00:00",
    "dateUpdated": "2024-08-08T02:12:35.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2003-0950

CVE-2003-0950 (GCVE-0-2003-0950)

Tags

Sightings

Nomenclature