PT-2003-1191 · Mywebserver · Mywebserver

Publicado 2003-03-18 · Atualizado 2016-10-18 · CVE-2002-1454

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyWebServer version 1.0.2

Description The issue allows remote attackers to determine the absolute path of the web document root. This is achieved by sending a request for a directory that does not exist, which in turn leaks the pathname in an error message.

Recommendations For MyWebServer version 1.0.2, consider modifying the error handling mechanism to avoid disclosing sensitive path information in error messages. As a temporary workaround, restrict access to non-existent directories to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-1454

Produtos afetados

Mywebserver

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html · Exploit
• http://iss.net/security_center/static/9862.php · Aviso do Fabricante
• http://securityfocus.com/bid/5471 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=102935720109934&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1454 · Nota de Segurança