CVE-2004-0917

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-01-27 · updated 2026-06-16

Description

The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to /diag.

Affected products

Vignette Application Portal: all versions

References

http://securitytracker.com/id?1011447
http://www.atstake.com/research/advisories/2004/a092804-1.txt
http://www.securityfocus.com/bid/11267
https://exchange.xforce.ibmcloud.com/vulnerabilities/17530
http://securitytracker.com/id?1011447
http://www.atstake.com/research/advisories/2004/a092804-1.txt
http://www.securityfocus.com/bid/11267
https://exchange.xforce.ibmcloud.com/vulnerabilities/17530

Get alerted when CVE-2004-0917 or the next vulnerability affects your stack