← Vulnerability feed

Vulnerability record · CVE-2002-2145 · published 31 December 2002

CVE-2002-2145: Savant webserver vulnerability

Savant · Savant Webserver

Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.

7.5 CVSS 2.0 High EPSS 7.7% · top 5.6%
7.5CVSS 2.0 base score
7.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://online.securityfocus.com/archive/1/291791
http://www.iss.net/security_center/static/10104.php
http://www.securityfocus.com/bid/5709 Exploit
http://online.securityfocus.com/archive/1/291791
http://www.iss.net/security_center/static/10104.php
http://www.securityfocus.com/bid/5709 Exploit

Track CVE-2002-2145 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2005-0338Savant webserver vulnerabilityBuffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request.EPSS 5.4%7.5CVE-2002-2146Savant webserver vulnerabilitycgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request.EPSS 2.6%5.0CVE-2002-1828Savant webserver vulnerabilitySavant Webserver 3.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request with a negative Content-Length value.EPSS 6.9%4.6CVE-2005-2859Savant webserver vulnerabilitySavant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges.EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2002-2145), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.