CVE-2002-0061
HighPublic exploitApache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically…
Published Apr 2, 2003 · Updated Aug 8, 2024
Key Facts
Patch immediately- CVE-2002-0061 is a high-severity vulnerability (CVSS 7.5 v2) affecting HTTP Server (Apache).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 50% probability of exploitation in the next 30 days.
- Fixed versions are available, including HTTP Server 1.3.24.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
50%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2002-0061 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | See advisory | 1.3.24 |
Patched Releases
HTTP Server
1.3.24
Timeline
Publicly disclosed
Apr 2, 2003
Last updated
Aug 8, 2024
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisory20020321 Vulnerability in Apache for Win32 batch file processing - Remote command execution
- advisory20020325 Apache 1.3.24 Released! (fwd)
- advisory[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- advisory[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- advisory[httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
FAQ
Common Questions.
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
Affected: HTTP Server (Apache). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including HTTP Server 1.3.24.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2002-0061 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo