CVE-2002-0654

published 2002-09-05

CVE-2002-0654: Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file…

Priority P4 23 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
debian	apache2	< apache2 2.0.40 (bookworm)	apache2 2.0.40 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

url http://target/error/HTTP_NOT_FOUND.html.var↗

• → Detect HTTP requests for .var files (e.g., HTTP_NOT_FOUND.html.var) targeting the Apache error document directory, which trigger full path disclosure in the error response on affected Apache 2.0.x Windows/OS2/Netware installations. ↗
• → Monitor HTTP responses from Apache 2.0 through 2.0.39 for full filesystem path strings leaked in error messages, triggered either by .var file requests or failed child process/script invocation. ↗

• · Vulnerability is limited to Apache 2.0 through 2.0.39 running on Windows, OS2, and Netware platforms only; Unix/Linux deployments are not affected. ↗
• · The issue is resolved in Apache 2.0.40; systems running 2.0.40 or later are not vulnerable. ↗

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 5.0 MEDIUM

vendor_debian 5.0 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.