CVE-2002-0292

Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field.

Published: May 31, 2002
Updated: Nov 9, 2025
CVE: CVE-2002-0292
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 2.6
AV:N/AC:H/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
open_source_development_network / slashcode	-	1.0.8.x
open_source_development_network / slashcode	2.0	2.0.x
open_source_development_network / slashcode	2.2.3	2.2.3.x
open_source_development_network / slashcode	2.2	2.2.x
open_source_development_network / slashcode	2.1	2.1.x
open_source_development_network / slashcode	2.2.1	2.2.1.x
open_source_development_network / slashcode	2.1.1	2.1.1.x
open_source_development_network / slashcode	2.2.2	2.2.2.x
open_source_development_network / slashcode	2.2.4	2.2.4.x

http://marc.info/?l=bugtraq&m=101414005501708&w=2
http://www.iss.net/security_center/static/8221.php
http://www.securityfocus.com/bid/4116

Vulnerability Database

CVE-2002-0292

Deep Security Visibility Without the Complexity