{"id":"CVE-2002-0787","aliases":["EUVD-2002-0779","GHSA-phh2-jhh8-w555"],"status":"published","title":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin...","description":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0288,"percentile":0.86943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2002-07-26T04:00:00Z","modified":"2026-06-16T21:58:08Z","exploits":[{"source":"exploitdb","id":"EDB-21444","title":"Critical Path InJoin Directory Server 4.0 - Cross-Site Scripting","type":"remote","platform":"multiple","date":"2002-05-10","verified":true,"url":"https://www.exploit-db.com/exploits/21444"}],"products":[{"vendor":"critical_path","product":"injoin_directory_server"}],"references":[{"url":"http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0068.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/4717","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","Vendor Advisory"]},{"url":"http://www.iss.net/security_center/static/9053.php","tags":["vdb-entry","x_refsource_XF","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0787"},{"url":"https://github.com/advisories/GHSA-phh2-jhh8-w555"}],"sources":{"cve":[{"id":"CVE-2002-0787","description":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.","status":"published","published":"2002-07-26T04:00:00Z","modified":"2024-08-08T03:03:48.904Z","updated_at":"2026-11-02T14:33:55.642267Z"}],"euvd":[{"id":"EUVD-2002-0779","description":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.","status":"published","published":"2002-07-26T04:00:00Z","modified":"2024-08-08T03:03:48Z","updated_at":"2026-11-03T01:14:59.095718Z"}],"ghsa":[{"id":"GHSA-phh2-jhh8-w555","title":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin...","description":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.","status":"published","published":"2022-04-30T18:19:55Z","modified":"2023-01-30T05:05:59Z","updated_at":"2026-11-02T14:47:23.939517Z"}],"nvd":[{"id":"CVE-2002-0787","description":"Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.","status":"published","published":"2002-08-12T04:00:00Z","modified":"2026-06-16T21:58:08.07Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:42.827505Z"}]}}