CVE-2002-0253: Medium severity PHP PHP vulnerability

Published May 3, 2002

Updated

PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and produces an error message that contains the path.

Affected Software

9 affected components

PHP PHP=4.1.0

PHP PHP=4.0.4

PHP PHP=4.0.5

PHP PHP=4.0

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.0.1

PHP PHP=4.0.3

Event History

May 3, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0253?

CVE-2002-0253 is considered a high-severity vulnerability due to its potential to expose sensitive filesystem information.

How do I fix CVE-2002-0253?

To fix CVE-2002-0253, ensure that the 'display_errors' directive is set to 'Off' in the php.ini configuration file.

What versions of PHP are affected by CVE-2002-0253?

CVE-2002-0253 affects PHP versions 4.0.0 through 4.1.2.

Can CVE-2002-0253 be exploited remotely?

Yes, CVE-2002-0253 can be exploited remotely by attackers who send crafted requests to affected PHP applications.

What are the potential consequences of CVE-2002-0253?

The potential consequences of CVE-2002-0253 include leakage of sensitive information about the server's file structure.