CVE-2001-1202: High severity Delegate DeleGate vulnerability

Published Dec 28, 2001

Updated

Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attackers to execute arbitrary Javascript on other clients via a URL that generates an error.

Affected Software

4 affected components

Delegate DeleGate=7.8.0

Delegate DeleGate=7.8.1

Delegate DeleGate=7.7.1

Delegate DeleGate=7.7.0

Remediation

Patch Available

http://www.iss.net/security_center/static/7745.php

Event History

Dec 28, 2001

CVE Published

05:00 AM

Mar 15, 2002

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1202?

CVE-2001-1202 is classified as a medium severity vulnerability due to the risk of cross-site scripting attacks.

How do I fix CVE-2001-1202?

To mitigate CVE-2001-1202, upgrade DeleGate to version 7.8.0 or later where the issue is addressed.

What impact does CVE-2001-1202 have on affected software?

CVE-2001-1202 allows attackers to execute arbitrary JavaScript in the context of other users' browsers through an improperly configured error page.

Which versions of DeleGate are affected by CVE-2001-1202?

CVE-2001-1202 affects DeleGate versions 7.7.0 and 7.7.1.

Can CVE-2001-1202 be exploited remotely?

Yes, CVE-2001-1202 can be exploited remotely through specially crafted URLs that trigger the vulnerable error page.