CVE-2002-1592: Medium severity Apache HTTP Server vulnerability

Published May 6, 2002

Updated

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.

Affected Software

4 affected components

Apache HTTP Server=2.0

Apache HTTP Server=2.0.28

Apache HTTP Server=2.0.32

Apache HTTP Server=2.0.35

Event History

May 6, 2002

CVE Published

04:00 AM

Mar 13, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1592?

CVE-2002-1592 is considered a medium severity vulnerability due to its potential for exposing sensitive information.

How do I fix CVE-2002-1592?

To fix CVE-2002-1592, upgrade to a patched version of Apache HTTP Server that does not expose the full path in error messages.

What platforms are affected by CVE-2002-1592?

CVE-2002-1592 affects Apache HTTP Server versions 2.0 through 2.0.35.

What type of vulnerability is CVE-2002-1592?

CVE-2002-1592 is an information disclosure vulnerability that arises from improper error handling in CGI applications.

Can CVE-2002-1592 be exploited remotely?

Yes, CVE-2002-1592 can be exploited remotely by attackers who can trigger CGI errors and access sensitive path information.