CVE-2002-0240

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-02417.5NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Di CVE-2002-02427.5Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML F CVE-2002-02437.5Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, w CVE-2002-02447.5Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to escape the jail via a .. (dot dot) in the pathname CVE-2002-02457.5Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a CVE-2002-02467.2Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying th CVE-2002-02477.2Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges.CVE-2002-02487.2wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file.CVE-2002-02495.0PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the CVE-2002-02507.5Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users CVE-2002-02517.5Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v CVE-2002-02527.5Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long