Every CVESearch/Get API key

CVE-2002-0654

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the...

5.0 MediumPublic exploitFix available

CVE-2002-0654 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published August 20, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.7%, the 99th percentile. Fixed in apache2 2.0.40.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
58.7%EPSS, 99th percentile
Exploitation
None known1 public exploit
Fixed in
2.0.40apache2 +2 more

Description

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Exploit likelihood

58.7%Up 25.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
before 2.0.40
2.0.40
apache2
Debian:13
before 2.0.40
2.0.40
apache2
Debian:14
before 2.0.40
2.0.40

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache 2.0 - Full Path Disclosure2002-08-16

What each source reports

NVD Score used5.0

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
CVE-2002-0654
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE ListNo score

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
CVE-2002-0654
Updated
2026-11-02
EUVDEUVD-2002-0648No score

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
EUVD-2002-0648
Updated
2026-11-03
GitHub AdvisoriesGHSA-4qm6-3vx6-hg5qNo score

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the...

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
GHSA-4qm6-3vx6-hg5q
Updated
2026-11-02
OSVNo score

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
CVE-2002-0654
Updated
2026-11-02
OSVDEBIAN-CVE-2002-0654No score

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

Record
DEBIAN-CVE-2002-0654
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 23 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open