CVE-2002-2024

published 2002-12-31

CVE-2002-2024: Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3)…

PriorityP49medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.92%

77.4th percentile

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
horde	imp	—	—
msrc	azl3_libdwarf_0.9.0-1_on_azure_linux_3.0	—	—
msrc	azl3_libdwarf_0.9.2-1_on_azure_linux_3.0	—	—
msrc	azl3_qemu_8.2.0-16_on_azure_linux_3.0	—	—
msrc	cbl2_libdwarf_0.9.0-3_on_cbl_mariner_2.0	—	—
msrc	cbl2_qemu_6.2.0-24_on_cbl_mariner_2.0	—	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

vendor_msrc8.1HIGH

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SERVER Generic PHP Remote File Include

suricata·2014-12-17

CVE-2002-0953 ET WEB_SERVER Generic PHP Remote File Include ET WEB_SERVER Generic PHP Remote File Include Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Generic PHP Remote File Include"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"allow_url_include"; http.uri.raw; content:"php|3a 2f 2f|input"; http.request_body; content:"<?php"; fast_pattern; reference:cve,2002-0953; reference:cve,2024-4577; classtype:attempted-user; sid:2019957; rev:6; metadata:affected_product Any, attack_target Server, created_at 2014_12_17, deployment Datacenter, confidence High, signature_severity Major, tag Remote_File_Include, updated_at 2024_06_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

Suricata

ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt

suricata·2011-06-10

CVE-2002-0953 ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt"; flow:established,to_server; http.uri; content:".php?"; content:"=php|3a|//"; reference:cve,2002-0953; reference:cve,2024-4577; reference:url,diablohorn.wordpress.com/2010/01/16/interesting-local-file-inclusion-method/; classtype:web-application-attack; sid:2013001; rev:5; metadata:created_at 2011_06_10, cve CVE_2002_0953, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

Suricata

GPL FTP CWD overflow attempt

suricata·2010-09-23

CVE-1999-0219 GPL FTP CWD overflow attempt GPL FTP CWD overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD overflow attempt"; flow:established,to_server; content:"CWD"; nocase; isdataat:100,relative; pcre:"/^CWD\s[^\n]{100}/smi"; reference:bugtraq,11069; reference:bugtraq,1227; reference:bugtraq,1690; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7950; reference:cve,1999-0219; reference:cve,1999-1058; reference:cve,1999-1510; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0781; reference:cve,2002-0126; reference:cve,2002-0405; classtype:attempted-admin; sid:2101919; rev:25; metadata:created_at 2010_09_23, cve CVE_1999_0219, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SNMP public access tcp

suricata·2010-09-23

CVE-1999-0517 GPL SNMP public access tcp GPL SNMP public access tcp Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"GPL SNMP public access tcp"; flow:established,to_server; content:"public"; reference:bugtraq,2112; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,7212; reference:cve,1999-0517; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:2101412; rev:15; metadata:created_at 2010_09_23, cve CVE_1999_0517, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT /iisadmpwd/aexp2.htr access

suricata·2010-09-23

CVE-1999-0407 GPL EXPLOIT /iisadmpwd/aexp2.htr access GPL EXPLOIT /iisadmpwd/aexp2.htr access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT /iisadmpwd/aexp2.htr access"; flow:established,to_server; http.uri; content:"/iisadmpwd/aexp2.htr"; reference:bugtraq,2110; reference:bugtraq,4236; reference:cve,1999-0407; reference:cve,2002-0421; reference:nessus,10371; classtype:web-application-activity; sid:2101487; rev:14; metadata:created_at 2010_09_23, cve CVE_1999_0407, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL NETBIOS xp_reg* - registry access

suricata·2010-09-23

CVE-2002-0642 GPL NETBIOS xp_reg* - registry access GPL NETBIOS xp_reg* - registry access Rule: alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"GPL NETBIOS xp_reg* - registry access"; flow:established,to_server; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:2100686; rev:12; metadata:created_at 2010_09_23, cve CVE_2002_0642, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP PASS overflow attempt

suricata·2010-09-23

CVE-1999-1519 GPL FTP PASS overflow attempt GPL FTP PASS overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP PASS overflow attempt"; flow:established,to_server,no_stream; content:"PASS"; nocase; isdataat:100,relative; pcre:"/^PASS\s[^\n]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,10720; reference:bugtraq,1690; reference:bugtraq,3884; reference:bugtraq,8601; reference:bugtraq,9285; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-1035; reference:cve,2002-0126; reference:cve,2002-0895; classtype:attempted-admin; sid:2101972; rev:19; metadata:created_at 2010_09_23, cve CVE_1999_1519, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SNMP private access tcp

suricata·2010-09-23

CVE-2002-0012 GPL SNMP private access tcp GPL SNMP private access tcp Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"GPL SNMP private access tcp"; flow:established,to_server; content:"private"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:2101414; rev:13; metadata:created_at 2010_09_23, cve CVE_2002_0012, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL RPC portmap cachefsd request TCP

suricata·2010-09-23

CVE-2002-0033 GPL RPC portmap cachefsd request TCP GPL RPC portmap cachefsd request TCP Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap cachefsd request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 8B|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,4674; reference:cve,2002-0033; reference:cve,2002-0084; classtype:rpc-portmap-decode; sid:2101747; rev:13; metadata:created_at 2010_09_23, cve CVE_2002_0033, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL WEB_SERVER perl post attempt

suricata·2010-09-23

CVE-2002-1436 GPL WEB_SERVER perl post attempt GPL WEB_SERVER perl post attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_SERVER perl post attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/perl/"; reference:bugtraq,5520; reference:cve,2002-1436; reference:nessus,11158; classtype:web-application-attack; sid:2101979; rev:8; metadata:created_at 2010_09_23, cve CVE_2002_1436, signature_severity Unknown, updated_at 2024_03_08;)

Suricata

GPL FTP LIST directory traversal attempt

suricata·2010-09-23

CVE-2002-1054 GPL FTP LIST directory traversal attempt GPL FTP LIST directory traversal attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP LIST directory traversal attempt"; flow:established,to_server; content:"LIST"; nocase; content:".."; distance:1; content:".."; distance:1; reference:cve,2002-1054; reference:bugtraq,2618; reference:nessus,11112; reference:cve,2001-0680; classtype:protocol-command-decode; sid:2101992; rev:12; metadata:created_at 2010_09_23, cve CVE_2001_0680, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)

Suricata

ET WEB_SERVER WEB-PHP phpinfo access

suricata·2010-09-23

CVE-2002-1149 ET WEB_SERVER WEB-PHP phpinfo access ET WEB_SERVER WEB-PHP phpinfo access Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER WEB-PHP phpinfo access"; flow:established,to_server; http.uri; content:"/phpinfo.php"; nocase; reference:bugtraq,5789; reference:cve,2002-1149; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=3356; classtype:successful-recon-limited; sid:2019526; rev:6; metadata:created_at 2010_09_23, cve CVE_2002_1149, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06;)

Suricata

GPL IMAP EXPLOIT partial body overflow attempt

suricata·2010-09-23

CVE-2002-0379 GPL IMAP EXPLOIT partial body overflow attempt GPL IMAP EXPLOIT partial body overflow attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP EXPLOIT partial body overflow attempt"; dsize:>1092; flow:established,to_server; content:" x PARTIAL 1 BODY["; reference:bugtraq,4713; reference:cve,2002-0379; classtype:misc-attack; sid:2101780; rev:11; metadata:created_at 2010_09_23, cve CVE_2002_0379, confidence Medium, signature_severity Minor, updated_at 2024_03_08;)

Suricata

GPL RPC portmap ypserv request TCP

suricata·2010-09-23

CVE-2000-1042 GPL RPC portmap ypserv request TCP GPL RPC portmap ypserv request TCP Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap ypserv request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A4|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,12; reference:bugtraq,5914; reference:bugtraq,6016; reference:cve,2000-1042; reference:cve,2000-1043; reference:cve,2002-1232; classtype:rpc-portmap-decode; sid:2101276; rev:16; metadata:created_at 2010_09_23, cve CVE_2000_1042, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL RPC portmap rpc.xfsmd request TCP

suricata·2010-09-23

CVE-2002-0359 GPL RPC portmap rpc.xfsmd request TCP GPL RPC portmap rpc.xfsmd request TCP Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap rpc.xfsmd request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|h"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,5072; reference:bugtraq,5075; reference:cve,2002-0359; classtype:rpc-portmap-decode; sid:2102082; rev:11; metadata:created_at 2010_09_23, cve CVE_2002_0359, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL NETBIOS xp_reg* registry access

suricata·2010-09-23

CVE-2002-0642 GPL NETBIOS xp_reg* registry access GPL NETBIOS xp_reg* registry access Rule: alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"GPL NETBIOS xp_reg* registry access"; flow:established,to_server; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; depth:32; offset:32; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:2100689; rev:13; metadata:created_at 2010_09_23, cve CVE_2002_0642, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SMTP EXPN overflow attempt

suricata·2010-09-23

CVE-2002-1337 GPL SMTP EXPN overflow attempt GPL SMTP EXPN overflow attempt Rule: alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"GPL SMTP EXPN overflow attempt"; flow:established,to_server; content:"EXPN"; nocase; isdataat:255,relative; content:!"|0a|"; within:255; pcre:"/^EXPN[^\n]{255}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2102259; rev:10; metadata:created_at 2010_09_23, cve CVE_2002_1337, confidence Medium, signature_severity Major, updated_at 2024_03_08;)

Suricata

ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)

suricata·2010-07-30

CVE-2002-0953 ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=) ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=) Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:".php?"; nocase; content:"cmd="; fast_pattern; nocase; pcre:"/[&?]cmd=[^\x26\x28]*(?:cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/i"; reference:cve,2002-0953; classtype:web-application-attack; sid:2010920; rev:10; metadata:created_at 2010_07_30, cve CVE_2002_0953, confidence Medium, signature_severity Major, updated_at 2024_01_03;)