CVE-2002-0417

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi programs.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://online.securityfocus.com/archive/1/259730Vendor Advisory
http://www.endymion.com/products/mailman/history.htm
http://www.iss.net/security_center/static/8357.phpVendor Advisory
http://www.securityfocus.com/bid/4222Exploit, Patch, Vendor Advisory
http://online.securityfocus.com/archive/1/259730Vendor Advisory
http://www.endymion.com/products/mailman/history.htm
http://www.iss.net/security_center/static/8357.phpVendor Advisory
http://www.securityfocus.com/bid/4222Exploit, Patch, Vendor Advisory

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-04185.0Directory traversal vulnerability in the com.endymion.sake.servlet.mail.MailServlet servlet for Endymion SakeMail 1.0.36 and earlier allows CVE-2002-04195.0Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force CVE-2002-04207.5Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user se CVE-2002-04215.0IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing prog CVE-2002-04222.6IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by CVE-2002-042310.0Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly exec CVE-2002-04244.6efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which CVE-2002-04255.0mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message i CVE-2002-04267.5VPN Server module in Linksys EtherFast BEFVP41 Cable/DSL VPN Router before 1.40.1 reduces the key lengths for keys that are supplied via man CVE-2002-042710.0Buffer overflows in fpexec in mod_frontpage before 1.6.1 may allow attackers to gain root privileges.CVE-2002-04287.5Check Point FireWall-1 SecuRemote/SecuClient 4.0 and 4.1 allows clients to bypass the "authentication timeout" by modifying the to_expire or CVE-2002-04293.6The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary proces