Servers and applications
CVE-2002-1233
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and…
- Severity
- Low 2.6
- Published
- 4 Nov 2002
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Exploit chance
- 0.6% in the next 30 daysHigher than 47% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Needs local access · Only under certain conditions · No login needed
- Attacker can
- Read some data · Change some data
- CVSS vector
AV:L/AC:H/Au:N/C:P/I:P/A:N- Sources
- NVD
Description
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
All 10 release lines
|