{"api_version":"1","generated_at":"2026-07-23T08:37:15+00:00","cve":"CVE-2002-0196","urls":{"html":"https://cve.report/CVE-2002-0196","api":"https://cve.report/api/cve/CVE-2002-0196.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0196","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0196"},"summary":{"title":"CVE-2002-0196","description":"GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-05-16 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/3924","name":"http://www.securityfocus.com/bid/3924","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ACD CwpAPI Relative Path Validation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.iss.net/security_center/static/7981.php","name":"http://www.iss.net/security_center/static/7981.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"ISS X-Force Database: cwpapi-getrelativepath-view-files (7981): CwpAPI GetRelativePath() function allows an attacker to view files","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://online.securityfocus.com/archive/1/251699","name":"http://online.securityfocus.com/archive/1/251699","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus home mailing list: BugTraq","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://sourceforge.net/forum/forum.php?forum_id=144966","name":"http://sourceforge.net/forum/forum.php?forum_id=144966","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SourceForge.net: News: CwpApi Version 1.1.1-Final (Security Fix)","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0196","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0196","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"acd_incorporated","cpe5":"cwpapi","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:42:28.488Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"3924","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/3924"},{"name":"cwpapi-getrelativepath-view-files(7981)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"http://www.iss.net/security_center/static/7981.php"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/forum/forum.php?forum_id=144966"},{"name":"20020122 (Repost) CwpApi : GetRelativePath() returns invalid paths (security advisory)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://online.securityfocus.com/archive/1/251699"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-01-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2007-02-07T00:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"3924","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/3924"},{"name":"cwpapi-getrelativepath-view-files(7981)","tags":["vdb-entry","x_refsource_XF"],"url":"http://www.iss.net/security_center/static/7981.php"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/forum/forum.php?forum_id=144966"},{"name":"20020122 (Repost) CwpApi : GetRelativePath() returns invalid paths (security advisory)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://online.securityfocus.com/archive/1/251699"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0196","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"3924","refsource":"BID","url":"http://www.securityfocus.com/bid/3924"},{"name":"cwpapi-getrelativepath-view-files(7981)","refsource":"XF","url":"http://www.iss.net/security_center/static/7981.php"},{"name":"http://sourceforge.net/forum/forum.php?forum_id=144966","refsource":"CONFIRM","url":"http://sourceforge.net/forum/forum.php?forum_id=144966"},{"name":"20020122 (Repost) CwpApi : GetRelativePath() returns invalid paths (security advisory)","refsource":"BUGTRAQ","url":"http://online.securityfocus.com/archive/1/251699"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0196","datePublished":"2002-06-25T04:00:00.000Z","dateReserved":"2002-05-01T00:00:00.000Z","dateUpdated":"2024-08-08T02:42:28.488Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-05-16 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:acd_incorporated:cwpapi:1.1:*:*:*:*:*:*:*","matchCriteriaId":"3FF5F0FC-785B-41DA-B640-62A52509E26F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"196","Ordinal":"1","Title":"CVE-2002-0196","CVE":"CVE-2002-0196","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"196","Ordinal":"1","NoteData":"GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.","Type":"Description","Title":"CVE-2002-0196"},{"CveYear":"2002","CveId":"196","Ordinal":"2","NoteData":"2002-06-25","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"196","Ordinal":"3","NoteData":"2007-02-06","Type":"Other","Title":"Modified"}]}}}