Lucene search

[email protected]CVE-2001-1247

HistoryJun 25, 2002 - 4:00 a.m.

CVE-2001-1247

2002-06-2504:00:00

CWE-264

[email protected]

web.nvd.nist.gov

php 4.0.4pl1

php 4.0.5

safe mode

remote attack

file access

web server

error_log function

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.3%

JSON

PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.

Affected configurations

NVD

Node

phpphpMatch4.0.4pl1

phpphpMatch4.0.5

CPENameOperatorVersion
php:phpphpeq4.0.4pl1
php:phpphpeq4.0.5

CPE	Name	Operator	Version
php:php	php	eq	4.0.4pl1
php:php	php	eq	4.0.5

References

online.securityfocus.com/archive/1/194425

www.osvdb.org/5440

www.php.net/do_download.php?download_file=php-4.1.2.tar.gz

www.redhat.com/support/errata/RHSA-2002-035.html

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.3%

JSON

Related for CVE-2001-1247

nvd1 cvelist1