Apache 2.0 up to and including 2.0.39 on Windows, OS2, and Netware allows remote malicious users to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
apache http server 2.0 |
||
apache http server 2.0.28 |
||
apache http server 2.0.32 |
||
apache http server 2.0.34 |
||
apache http server 2.0.35 |
||
apache http server 2.0.36 |
||
apache http server 2.0.37 |
||
apache http server 2.0.38 |
||
apache http server 2.0.39 |