Vulnerability Description
The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | 2.0 |
References
- http://www.apache.org/dist/httpd/CHANGES_2.0
- http://www.iss.net/security_center/static/9623.php
- http://www.kb.cert.org/vuls/id/165803US Government Resource
- http://www.securityfocus.com/bid/5256
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e0593
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181e
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b21
- https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390
- https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426
- https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f08
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f8
- https://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e33
- https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1e
FAQ
What is CVE-2002-1592?
CVE-2002-1592 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote at...
How severe is CVE-2002-1592?
CVE-2002-1592 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2002-1592?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server.