Apache: >> Http Server >> 2.0 Security Vulnerabilities
Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
CVSS Score
5.0
EPSS Score
0.587
Published
2002-09-05
Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
CVSS Score
7.5
EPSS Score
0.697
Published
2002-08-12
The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
CVSS Score
5.0
EPSS Score
0.125
Published
2002-05-06
htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
CVSS Score
3.3
EPSS Score
0.023
Published
2001-03-12
Page 8