CVE-2002-0240

PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=101311746611160&w=2
http://www.iss.net/security_center/static/8119.php
http://www.securityfocus.com/bid/4057	Vendor Advisory
http://marc.info/?l=bugtraq&m=101311746611160&w=2
http://www.iss.net/security_center/static/8119.php
http://www.securityfocus.com/bid/4057	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*

History

20 Nov 2024, 23:38

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=bugtraq&m=101311746611160&w=2 -~~	() http://marc.info/?l=bugtraq&m=101311746611160&w=2 -
References	~~() http://www.iss.net/security_center/static/8119.php -~~	() http://www.iss.net/security_center/static/8119.php -
References	~~() http://www.securityfocus.com/bid/4057 - Vendor Advisory~~	() http://www.securityfocus.com/bid/4057 - Vendor Advisory

Information

Published : 2002-05-29 04:00

Updated : 2024-11-20 23:38

NVD link : CVE-2002-0240

Mitre link : CVE-2002-0240

CVE.ORG link : CVE-2002-0240

JSON object : View

Products Affected

apache

http_server

CWE

NVD-CWE-Other

{"id": "CVE-2002-0240", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-05-29T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=101311746611160&w=2", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8119.php", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4057", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=101311746611160&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.iss.net/security_center/static/8119.php", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/4057", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message."}, {"lang": "es", "value": "PHP, cuando se instala con Apache y se configura para buscar index.php como la p\u00e1gina web por defecto, permite a los atacantes remotos que obtengan el path completo del servidor por medio del m\u00e9todo HTTP OPTIONS, lo cual revelar\u00e1 el nombre del path en el mensaje de error correspondiente."}], "lastModified": "2024-11-20T23:38:37.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C4962BB-0E61-4788-B582-21F05CD33AD3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}