CVE-2002-0249: Medium severity Apache HTTP Server vulnerability

Published May 3, 2002

Updated

PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.

Affected Software

1 affected component

Apache HTTP Server=2.0.28-beta

Event History

May 3, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0249?

CVE-2002-0249 is classified as a medium severity vulnerability due to potential information disclosure.

How do I fix CVE-2002-0249?

To fix CVE-2002-0249, upgrade to a later version of Apache HTTP Server that does not use PHP as a CGI module.

What kind of attack does CVE-2002-0249 enable?

CVE-2002-0249 enables attackers to obtain the physical path of the php.exe file through specially crafted requests.

Which versions of Apache are affected by CVE-2002-0249?

CVE-2002-0249 specifically affects Apache HTTP Server version 2.0.28 beta when PHP is installed as a standalone CGI.

How can I determine if my system is vulnerable to CVE-2002-0249?

You can determine vulnerability to CVE-2002-0249 by checking if your Apache installation is version 2.0.28 beta and if PHP is configured as a CGI.