{"api_version":"1","generated_at":"2026-07-23T04:55:19+00:00","cve":"CVE-2002-1837","urls":{"html":"https://cve.report/CVE-2002-1837","api":"https://cve.report/api/cve/CVE-2002-1837.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-1837","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-1837"},"summary":{"title":"CVE-2002-1837","description":"The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via \"..\" sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/4870","name":"http://www.securityfocus.com/bid/4870","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Image Display System Directory Existence Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://online.securityfocus.com/archive/1/274433","name":"http://online.securityfocus.com/archive/1/274433","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus HOME Mailing List: BugTraq","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://ids.sourceforge.net/ChangeLog.html","name":"http://ids.sourceforge.net/ChangeLog.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IDS: Changelog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.iss.net/security_center/static/9201.php","name":"http://www.iss.net/security_center/static/9201.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ISS X-Force Database: ids-dir-existence (9201): Image Display System (IDS) could allow an attacker to determine whether a directory exists","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-1837","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-1837","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"1837","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ids","cpe5":"ids","cpe6":"0.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T03:43:33.464Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ids-dir-existence(9201)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"http://www.iss.net/security_center/static/9201.php"},{"name":"20020528 Information Disclosure Vulnerability in IDS 0.8x","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://online.securityfocus.com/archive/1/274433"},{"name":"4870","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/4870"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://ids.sourceforge.net/ChangeLog.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-05-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via \"..\" sequences in the album parameter, which generates different error messages depending on whether the directory exists or not."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-06-15T16:39:20.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"ids-dir-existence(9201)","tags":["vdb-entry","x_refsource_XF"],"url":"http://www.iss.net/security_center/static/9201.php"},{"name":"20020528 Information Disclosure Vulnerability in IDS 0.8x","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://online.securityfocus.com/archive/1/274433"},{"name":"4870","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/4870"},{"tags":["x_refsource_CONFIRM"],"url":"http://ids.sourceforge.net/ChangeLog.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-1837","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via \"..\" sequences in the album parameter, which generates different error messages depending on whether the directory exists or not."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ids-dir-existence(9201)","refsource":"XF","url":"http://www.iss.net/security_center/static/9201.php"},{"name":"20020528 Information Disclosure Vulnerability in IDS 0.8x","refsource":"BUGTRAQ","url":"http://online.securityfocus.com/archive/1/274433"},{"name":"4870","refsource":"BID","url":"http://www.securityfocus.com/bid/4870"},{"name":"http://ids.sourceforge.net/ChangeLog.html","refsource":"CONFIRM","url":"http://ids.sourceforge.net/ChangeLog.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-1837","datePublished":"2005-06-28T04:00:00.000Z","dateReserved":"2005-06-29T00:00:00.000Z","dateUpdated":"2024-08-08T03:43:33.464Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ids:ids:0.8.1:*:*:*:*:*:*:*","matchCriteriaId":"887E5B32-A6B7-4BE7-93A5-57D03FA2ECE5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"1837","Ordinal":"1","Title":"CVE-2002-1837","CVE":"CVE-2002-1837","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"1837","Ordinal":"1","NoteData":"The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via \"..\" sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.","Type":"Description","Title":"CVE-2002-1837"},{"CveYear":"2002","CveId":"1837","Ordinal":"2","NoteData":"2005-06-28","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"1837","Ordinal":"3","NoteData":"2021-06-15","Type":"Other","Title":"Modified"}]}}}