CVE-2002-1042

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-10-04 · updated 2026-06-16

Description

Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter.

Affected products

Netscape Enterprise Server: 3.6
Sun Iplanet Web Server: 4.1, 4.1-sp1, 4.1-sp10, 4.1-sp2, 4.1-sp3, 4.1-sp4 (+5)
Sun One Application Server: 6.0, 6.0-sp1, 6.0-sp2
Sun One Web Server: 6.0-sp3

References

http://archives.neohapsis.com/archives/bugtraq/2002-07/0085.html
http://www.iss.net/security_center/static/9517.php
http://www.securityfocus.com/bid/5191
http://archives.neohapsis.com/archives/bugtraq/2002-07/0085.html
http://www.iss.net/security_center/static/9517.php
http://www.securityfocus.com/bid/5191

Get alerted when CVE-2002-1042 or the next vulnerability affects your stack