CVE-2001-0947: Forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) 3.3 through 4.2.1 allows remote att...

Security readout for executives and security teams

This old CVE describes an information disclosure flaw in ValiCert Enterprise Validation Authority. A remote request to the Forms.exe CGI program can make the server reveal its real filesystem path in an error page. That does not by itself prove compromise, but it can help attackers map the server for later attacks. Exposure is most likely limited to legacy ValiCert EVA 3.3 through 4.2.1 systems with Forms.exe reachable over HTTP. The bundle’s normalized affected-product fields are incomplete, so validate through inventory and service inspection. Low urgency unless the product is still internet-facing. Prioritize discovery because legacy certificate-validation infrastructure can be sensitive, and path disclosure can support broader intrusion planning. Mitigation focus: Identify any deployed ValiCert EVA instances and their versions.; Remove public access to Forms.exe unless business-critical.; Review ValiCert advisory guidance before applying product-specific fixes..

Prepared

Jul 1, 2026, 08:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.