CVE-2002-1484

Critical

Published: 22/04/2003(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems via a request for a URL that specifies the target IP address and port.

Risk Assessment

Attackers can perform port scanning on other systems, potentially leading to the exposure of information about the organization's network infrastructure.

Recommendation

It is recommended to disable verbose debug messages in the DB4Web server configuration to minimize the risk of exploitation of this vulnerability.

Original NVD description (English source)

DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.