PT-2003-1191 · Mywebserver · Mywebserver

Published 2003-03-18 · Updated 2016-10-18 · CVE-2002-1454

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyWebServer version 1.0.2

Description The issue allows remote attackers to determine the absolute path of the web document root. This is achieved by sending a request for a directory that does not exist, which in turn leaks the pathname in an error message.

Recommendations For MyWebServer version 1.0.2, consider modifying the error handling mechanism to avoid disclosing sensitive path information in error messages. As a temporary workaround, restrict access to non-existent directories to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1454

Affected Products

Mywebserver

References · 5

• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0077.html · Exploit
• http://iss.net/security_center/static/9862.php · Vendor Advisory
• http://securityfocus.com/bid/5471 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1454 · Security Note
• http://marc.info/?l=bugtraq&m=102935720109934&w=2 · Note