CVE-2002-0310: High severity Netwin WebNews vulnerability
Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations (1) testweb/newstest, (2) alwn3845/imaptest, (3) alwi3845/wtest3452, or (4) testweb2/wtest4879.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0310?
CVE-2002-0310 is classified as a high severity vulnerability due to the use of default usernames and cleartext passwords that allow unauthorized access.
How do I fix CVE-2002-0310?
To fix CVE-2002-0310, administrators should upgrade to a non-vulnerable version of Netwin WebNews that does not include these default credentials.
Which versions of Netwin WebNews are affected by CVE-2002-0310?
CVE-2002-0310 affects Netwin WebNews versions 1.1h, 1.1i, 1.1j, and 1.1k.
What are the default username/password combinations in CVE-2002-0310?
The default credentials for CVE-2002-0310 include testweb/newstest, alwn3845/imaptest, and alwi3845/wtest3452.
Can an administrator delete the default credentials in CVE-2002-0310?
No, administrators cannot delete the default usernames and passwords in CVE-2002-0310, which contributes to the security risk.