BSCW 3.4/4.0 - Insecure Default Installation

Author: Thomas Seliger
type: remote
platform: multiple
port: 
date_added: 2002-01-03 
date_updated: 2012-09-09 
verified: 1 
codes: CVE-2002-0095;OSVDB-5374 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/3777/info

BSCW (Basic Support for Cooperative Work) is a web-based groupware application, allowing users to share a workspace via a web interface. It runs on Microsoft Windows NT/2000 systems, as well as a number of Unix variants.

The default installation allows users to self-register, potentially allowing untrusted users to access the service.

This may provide a window of opportunity for an untrusted, malicious user to access the service to exploit known issues. One example of an existing issue that may be exploited as a result of untrusted users being able to self-register is BugTraq ID 3776 "BSCW Remote Command Execution Vulnerability".

http://your.bscwserver.url/pub/english.cgi?op=rmail