MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arb…

Published 24 y ago 2002-06-11 · modified 4 mo ago 2026-06-16 · JSON

CVSS

3.7

v2.0 · NVD

CISA KEV

not known exploited

EPSS

0.9%

percentile 60%

Public exploits

Exploit-DB

MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbitrary files via a symlink attack on a temporary file, followed by a request to MultiFileUpload.php.

Exploit prediction (EPSS)

0.91% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

Exploits and detections

EDB-21335 Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (2) · remote · 2002-03-08
EDB-21334 Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (1) · remote · 2002-03-08

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	3.7	`AV:L/AC:H/Au:N/C:P/I:P/A:P`

References

securityfocus.com /bid/4252 · vdb-entry, x_refsource_BID, x_transferred
archives.neohapsis.com /archives/bugtraq/2002-03/0081.html · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

CVE List: CVE-2002-0430
NVD: CVE-2002-0430

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary

Exploit prediction (EPSS)

Exploits and detections

CVSS scores

References

Sources