CVE-2002-0654: Apache HTTP Server path disclosure via error messages on Windows, OS2, Netware

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityIt is an unauthenticated remote information disclosure with a high EPSS score, but it only reveals a pathname and no exploit code is confirmed in the record.

What it is

Apache 2.0 through 2.0.39 on Windows, OS2 and Netware leaks the server's full pathname in error messages. A remote request for a .var file, or an error triggered when a script child process cannot be invoked, returns the path in the response. The exposure is information disclosure only, but the leaked path aids follow-on attacks that depend on knowing the install layout.

Impact

An attacker learns the full server filesystem pathname, which can be used to tailor later attacks or locate writable or sensitive directories. No code execution, data modification or denial of service is granted by this flaw itself.

Attack surface

Reachable remotely over the network with no authentication and no user interaction, per the AV:N/AC:L/Au:N vector. The attacker simply sends a crafted request for a .var file or induces a script invocation failure to trigger the error message.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.58676, 99th percentile), but the references carry no exploit tags, so the record does not confirm public exploit code.

What to do

• Upgrade Apache HTTP Server past 2.0.39 to a release where the path disclosure is fixed; this is the primary action.
• If upgrade is not possible, suppress or sanitize server error output so filesystem paths are not returned to clients.
• Restrict serving of .var and similar non-content files, and review script invocation failures that echo internal paths.
• Apply the vendor advisory guidance in the Apache CHANGES_2.0 reference for the affected Windows, OS2 and Netware builds.

Detection

• Search web server error logs for requests to .var files or other unusual extensions that trigger path-bearing errors.
• Monitor responses for absolute filesystem paths (drive letters or install directories) leaking in error bodies.
• Alert on repeated script invocation failures from the same client, which may indicate deliberate probing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.