vulnwire
5.0med

CVE-2000-07201 exploit

news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote atta…

Published 26 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.2%
percentile 94%
Public exploits
1
Exploit-DB

news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to add new authors by directly posting an HTTP request to the new.cgi program with an addAuthor parameter, and setting the Referer to the news.cgi program.

Exploit prediction (EPSS)

6.16% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-20183 GWScripts News Publisher 1.0 - 'author.file' Write · remote · 2000-08-29

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/5169 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/1621 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /templates/archive.pike?list=1&msg=003301c0123b%2418f8c1a0%24953b29d4%40e8s9s4 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.