CVE-2002-0786: iCon administrative web server for Critical Path inJoin Directory Server 4.0 allows authenticated inJoin ad...

Security readout for executives and security teams

CVE-2002-0786 is an arbitrary file-read flaw in the iCon administrative web server for Critical Path inJoin Directory Server 4.0. An authenticated inJoin administrator could request local files through the LOG parameter. The business risk is exposure of sensitive server files, but the available sources do not show public active exploitation. Exposure appears limited to organizations still running Critical Path inJoin Directory Server 4.0 with the iCon administrative web server available to authenticated administrators. Risk increases if the admin interface is reachable from broad internal networks or if administrator accounts are weakly controlled. Treat this as a targeted legacy-system risk. It is not KEV-listed and requires administrator authentication, but arbitrary file read can expose credentials or configuration. Prioritize confirmation and retirement or isolation of any remaining inJoin 4.0 administration services. Mitigation focus: Inventory for Critical Path inJoin Directory Server 4.0 and the iCon administrative web server.; Restrict iCon administrative access to trusted management networks and authorized administrators only.; Review vendor or successor guidance for patches, upgrades, or retirement options..

Prepared

Jul 1, 2026, 06:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.