CVE-2002-0096

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The installation of Geeklog 1.3 creates an extra group_assignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://geeklog.sourceforge.net/index.php?topic=Security
http://www.iss.net/security_center/static/7780.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/248367Patch, Vendor Advisory
http://www.securityfocus.com/bid/3783Patch, Vendor Advisory
http://geeklog.sourceforge.net/index.php?topic=Security
http://www.iss.net/security_center/static/7780.phpPatch, Vendor Advisory
http://www.securityfocus.com/archive/1/248367Patch, Vendor Advisory
http://www.securityfocus.com/bid/3783Patch, Vendor Advisory

Timeline

Published: Mar 25, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-00977.5Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent CVE-2002-00987.5Buffer overflow in index.cgi administration interface for Boozt! Standard 0.9.8 allows local users to execute arbitrary code via a long name CVE-2002-00995.0Buffer overflow in Michael Lamont Savant Web Server 3.0 allows remote attackers to cause a denial of service (crash) via a long HTTP request CVE-2002-01007.5AOL AOLserver 3.4.2 Win32 allows remote attackers to bypass authentication and read password-protected files via a URL that directly referen CVE-2002-01015.0Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showMo CVE-2002-01025.0Oracle9iAS Web Cache 2.0.0.x allows remote attackers to cause a denial of service via (1) a request to TCP ports 1100, 4000, 4001, and 4002 CVE-2002-01034.6An installer program for Oracle9iAS Web Cache 2.0.0.x creates executable and configuration files with insecure permissions, which allows loc CVE-2002-01045.0AFTPD 5.4.4 allows remote attackers to gain sensitive information via a CD (CWD) ~ (tilde) command, which causes a core dump.CVE-2002-01057.2CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /CVE-2002-01065.0BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an CVE-2002-01075.0Web administration interface in CacheFlow CacheOS 4.0.13 and earlier allows remote attackers to obtain sensitive information via a series of CVE-2002-01087.5Allaire Forums 2.0.4 and 2.0.5 and Forums! 3.0 and 3.1 allows remote authenticated users to spoof messages as other users by modifying the h