Description

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Remediation

References

CVE-2002-0654

Related Vulnerabilities

WordPress Plugin Modern Events Calendar Lite Security Bypass (5.1.6)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-6514)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-6211)

Grafana Externally Controlled Reference to a Resource in Another Sphere Vulnerability (CVE-2021-41244)

Oracle JRE CVE-2023-21967 Vulnerability (CVE-2023-21967)

Severity

Medium

Classification

CVE-2002-0654

Tags

Missing Update Known Vulnerabilities