PatchTheCVEcspassword vulnerabilities and fixes
Recent CVEs affecting cspassword, with upgrade or downgrade steps. 4 tracked.
cspassword has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2002-10-04. Highest priority: CVE-2002-0919 (score 53/100).
- CVE-2002-0920 MEDIUM 5.1 DOWNGRADE CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file
- CVE-2002-0919 HIGH 7.5 DOWNGRADE CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privilege
- CVE-2002-0918 MEDIUM 5.0 DOWNGRADE CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages
- CVE-2002-0917 HIGH 7.5 DOWNGRADE CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote auth
FAQ
How do I fix cspassword vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cspassword being exploited right now?
None of the tracked cspassword CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cspassword CVE should I patch first?
CVE-2002-0919 currently ranks highest (53/100): CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privilege.