Vulnerability Description
Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | 2.0.36 |
References
- http://marc.info/?l=apache-httpd-announce&m=104313442901017&w=2
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e0593
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181e
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b21
- https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390
- https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4
- https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426
- https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f08
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f8
- https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1b
- https://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e33
- https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1e
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90b
FAQ
What is CVE-2003-0017?
CVE-2003-0017 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename...
How severe is CVE-2003-0017?
CVE-2003-0017 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-0017?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server.