CVE-2002-1603
mediumpriority · track · 35EPSS 0.137 · 96 %ileexploit · functionalEUUSEPSS · scored 2026-10-26
GoAhead Web Server 2.1.7 and earlier allows remote attackers to obtain the source code of ASP files via a URL terminated with a /, \, %2f (encoded /), %20 (encoded space), or %00 (encoded null) character, which returns the ASP source code unparsed.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- EDB-23446GoAhead Web Server 2.1.x - '.ASP' File Source Code Disclosurefunctional · exploit_db
affected products (10)
Products and version ranges known to be affected.
- goahead software goahead webserver= 2.0nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.1nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.2nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.3nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.4nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.5nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.6nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
- goahead software goahead webserver= 2.1.7nvdUScpe:2.3:a:goahead_software:goahead_webserver:*:*:*:*:*:*:*:*
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (26)
External citations — patches, advisories, analysis.
- http://aluigi.altervista.org/adv/goahead-adv3.txtenisa_euvd
- http://data.goahead.com/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-aspenisa_euvd
- http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729enisa_euvd
- http://secunia.com/advisories/7741enisa_euvd
- http://securitytracker.com/id?1005820enisa_euvd
- http://www.kb.cert.org/vuls/id/124059enisa_euvd
- http://www.kb.cert.org/vuls/id/975041enisa_euvd
- http://www.kb.cert.org/vuls/id/RGII-7MWKZ3enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan