vulnwire
10.0crit

CVE-2002-24171 exploit

acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.2%
percentile 91%
Public exploits
1
Exploit-DB

acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges.

Exploit prediction (EPSS)

4.18% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

Exploits and detections

  • EDB-22032 acFTP 1.4 - Invalid Password Weak Authentication · remote · 2002-11-25

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • securityfocus.com /bid/6235 · vdb-entry, x_refsource_BID, x_transferred
  • securityreason.com /securityalert/3334 · third-party-advisory, x_refsource_SREASON, x_transferred
  • iss.net /security_center/static/10681.php · vdb-entry, x_refsource_XF, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2002-q4/0088.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • securityfocus.com /archive/1/300929 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.