Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2002-0736

Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank.

Published

2002-08-12T04:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	microsoft	backoffice	4.0	Yes
Application	microsoft	backoffice	4.5	Yes

References

http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html ([email protected])
http://support.microsoft.com/support/kb/articles/q316/8/38.asp Patch, Vendor Advisory ([email protected])
http://www.iss.net/security_center/static/8862.php Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/4528 Patch, Vendor Advisory ([email protected])
http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html (af854a3a-2127-422b-91ae-364da2661108)
http://support.microsoft.com/support/kb/articles/q316/8/38.asp Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.iss.net/security_center/static/8862.php Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/4528 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)