Description

The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.

Remediation

References

CVE-2002-1635

Related Vulnerabilities

WordPress Plugin SecuPress Pro Security Bypass (1.4.12)

Moodle Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2024-25983)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2023-28625)

MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-41800)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36401)

Severity

Medium

Classification

CVE-2002-1635

Tags

Missing Update Known Vulnerabilities