Description
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password.
Affected products
cgi: script center news update
References6
- archives.neohapsis.com/archives/bugtraq/2000-10/0402.html Broken LinkVendor Advisory
- www.securityfocus.com/bid/1881 Broken LinkExploitThird Party AdvisoryVDB EntryVendor Advisory
- archives.neohapsis.com/archives/bugtraq/2000-10/0402.html Broken LinkVendor Advisory
- www.securityfocus.com/bid/1881 Broken LinkExploitThird Party AdvisoryVDB EntryVendor Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/5433 Third Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/5433 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 11% percentile: 96 · as of 8 November 2026
- CWE
- CWE-522
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.