CVE-2002-0236

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program, which returns a valid cookie for the desired user.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101294507827698&w=2
http://www.iss.net/security_center/static/7936.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/3784Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=101294507827698&w=2
http://www.iss.net/security_center/static/7936.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/3784Exploit, Patch, Vendor Advisory

Timeline

Published: May 29, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-02377.5Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remot CVE-2002-02387.5Cross-site scripting vulnerability in web administration interface for NetGear RT314 and RT311 Gateway Routers allows remote attackers to ex CVE-2002-02397.2Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn, (2) -hfb, or (3)CVE-2002-02405.0PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pat CVE-2002-02417.5NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Di CVE-2002-02427.5Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML F CVE-2002-02437.5Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, w CVE-2002-02447.5Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname CVE-2002-02457.5Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a CVE-2002-02467.2Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying th CVE-2002-02477.2Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges.CVE-2002-02487.2wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file.