CVE-ID

CVE-1999-0287
Learn more at National Vulnerability Database (NVD)
• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Vulnerability in the Wguest CGI program.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
19990607 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Proposed (19990714)
Votes (Legacy)
MODIFY(2) Frech, Shostack
NOOP(4) Blake, Levy, Northcutt, Wall
REJECT(2) Baker, Christey
Comments (Legacy) 
 Shostack> allows file reading
 Frech> XF:http-cgi-webcom-guestbook
 Christey> CVE-1999-0287 is probably a duplicate of CVE-1999-0467.  In
   NTBUGTRAQ:19990409 Webcom's CGI Guestbook for Win32 web servers
   Mnemonix says that he had previously reported on a similar
   problem.  Let's refer to the NTBugtraq posting as
   CVE-1999-0467.  We will refer to the "previous report" as
   CVE-1999-0287, which could be found at:
   http://oliver.efri.hr/~crv/security/bugs/NT/httpd41.html
   
   0287 describes an exploit via the "template" hidden variable.
   The exploit describes manually editing the HTML form to
   change the filename to read from the template variable.
   
   The exploit as described in 0467 encodes the template variable
   directly into the URL.  However, hidden variables are also
   encoded into the URL, which would have looked the same to
   the web server regardless of the exploit.  Therefore 0287
   and 0467 are the same.
 Christey> BID:2024
Proposed (Legacy)
19990714
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
  
You can also search by reference using the CVE Reference Maps.
For More Information:  CVE Request Web Form (select "Other" from dropdown)
Back to top