CVE-2002-1149 - Vulnerability Details - OpenCVE

The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00837.

Key SSVC decision points have not yet been added.

Vendors	Products
Invision Power Services	Invision Board

Configuration 1 [-]

OR	cpe:2.3:a:invision_power_services:invision_board:1.0:::::::*
	cpe:2.3:a:invision_power_services:invision_board:1.0.1:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2002-1136	The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://marc.info/?l=bugtraq&m=103290602609197&w=2
http://www.iss.net/security_center/static/10178.php
http://www.osvdb.org/3356
http://www.securityfocus.com/bid/5789

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2002-10-01T04:00:00

Updated: 2024-08-08T03:12:17.120Z

Reserved: 2002-09-24T00:00:00

Link: CVE-2002-1149

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2002-10-11T04:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2002-1149

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2002-09-24T00:00:00", "descriptions": [{"lang": "en", "value": "The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-10-17T13:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20020924 Information Disclosure with Invision Board installation (fwd)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=103290602609197&w=2"}, {"name": "invision-phpinfo-information-disclosure(10178)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "http://www.iss.net/security_center/static/10178.php"}, {"name": "3356", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/3356"}, {"name": "5789", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/5789"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-1149", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20020924 Information Disclosure with Invision Board installation (fwd)", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=103290602609197&w=2"}, {"name": "invision-phpinfo-information-disclosure(10178)", "refsource": "XF", "url": "http://www.iss.net/security_center/static/10178.php"}, {"name": "3356", "refsource": "OSVDB", "url": "http://www.osvdb.org/3356"}, {"name": "5789", "refsource": "BID", "url": "http://www.securityfocus.com/bid/5789"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T03:12:17.120Z"}, "title": "CVE Program Container", "references": [{"name": "20020924 Information Disclosure with Invision Board installation (fwd)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=103290602609197&w=2"}, {"name": "invision-phpinfo-information-disclosure(10178)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "http://www.iss.net/security_center/static/10178.php"}, {"name": "3356", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/3356"}, {"name": "5789", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/5789"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-1149", "datePublished": "2002-10-01T04:00:00", "dateReserved": "2002-09-24T00:00:00", "dateUpdated": "2024-08-08T03:12:17.120Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:invision_power_services:invision_board:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "7AC7F0E6-7DA6-41E3-9F73-4FFF699195C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:invision_power_services:invision_board:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "EAA35A95-B8FD-4ED8-95E0-409E50BF13AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings."}, {"lang": "es", "value": "El procedimiento de instalaci\u00f3n en Invision Board sugiere que los usuarios instalen el programa phpinfo.php en la ra\u00edz del web, lo que filtra informaci\u00f3n sensible como nombres de rutas, informaci\u00f3n del SO, y configuraci\u00f3n de php."}], "id": "CVE-2002-1149", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2002-10-11T04:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=103290602609197&w=2"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.iss.net/security_center/static/10178.php"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/3356"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/5789"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=103290602609197&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.iss.net/security_center/static/10178.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/3356"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/5789"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}