CVE-2002-0484: Medium severity PHP PHP vulnerability

Published Aug 12, 2002

Updated

moveuploadedfile in PHP does not does not check for the base directory (openbasedir), which could allow remote attackers to upload files to unintended locations on the system.

Affected Software

36 affected components

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.1.0

PHP PHP=4.0.4

PHP PHP=4.0.5

PHP PHP=3.0.8

PHP PHP=3.0.13

PHP PHP=4.0.7-rc2

PHP PHP=4.0.7-rc1

PHP PHP=3.0.7

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=3.0.18

PHP PHP=4.0.1

PHP PHP=3.0.12

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

Event History

Aug 12, 2002

CVE Published

04:00 AM

Apr 2, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0484?

CVE-2002-0484 is considered important due to its potential for remote file uploads to unintended locations.

How do I fix CVE-2002-0484?

To fix CVE-2002-0484, ensure that open_basedir is correctly configured in your PHP environment to restrict file uploads.

What versions of PHP are affected by CVE-2002-0484?

CVE-2002-0484 affects multiple versions of PHP, including 3.x and 4.x versions, specifically listed in the vulnerability description.

Can I prevent CVE-2002-0484 by updating PHP?

Updating PHP to a version that addresses the vulnerability is the recommended way to prevent CVE-2002-0484.

Are there any workarounds for CVE-2002-0484?

A workaround for CVE-2002-0484 involves reviewing and safeguarding file upload directories to limit access until a patch can be applied.