CVE-2000-0237: Medium severity Netscape Enterprise Server vulnerability
Netscape Enterprise Server with Web Publishing enabled allows remote attackers to list arbitrary directories via a GET request for the /publisher directory, which provides a Java applet that allows the attacker to browse the directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Netscape Enterprise Server Web Publishingfrom your environment.Uninstall or remove the Web Publishing component (the /publisher service/applet) if it is not required.
- Configuration
Disable the Web Publishing feature in Netscape Enterprise Server to prevent the /publisher Java applet from serving directory listings.
Netscape Enterprise Server (Web Publishing) Web Publishing = disabled - Configuration
Disable directory listing for the /publisher directory and remove or disable the Java applet that provides directory-browsing functionality.
Netscape Enterprise Server (publisher directory) directory_listing / publisher_applet = disabled / removed - Compensating control
Restrict access to the /publisher directory to trusted IPs or internal networks (via firewall, web server access controls, or ACLs) until the vulnerable functionality is disabled or removed.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0237?
CVE-2000-0237 has a medium severity rating as it can allow unauthorized directory browsing.
How do I fix CVE-2000-0237?
To fix CVE-2000-0237, disable the Web Publishing feature in Netscape Enterprise Server.
What are the affected versions in CVE-2000-0237?
CVE-2000-0237 affects Netscape Enterprise Server versions 3.5 and 3.6.
What type of attack does CVE-2000-0237 allow?
CVE-2000-0237 allows remote attackers to list arbitrary directories via a specially crafted GET request.
Is CVE-2000-0237 specific to a single platform?
No, CVE-2000-0237 is specific to Netscape Enterprise Server software and not tied to a single platform.