Is CVE-1999-0068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0068 being exploited in the wild.

How severe is CVE-1999-0068?

High severity, with a CVSS score of 7.5, published 19 October 1997.

Is there a fix for CVE-1999-0068?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0068 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-1999-0068?

Check whether you run PHP Mylog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0068: PHP mylog script arbitrary file disclosure

CVE-1999-0068 · Severity: high · CVSS 7.5 · Published 1997-10-19

The mylog script, a legacy PHP-based tool used for web logging, contains a security flaw that allows unauthorized users to view any file on the host server. This could lead to the exposure of sensitive system configuration files, passwords, or customer data. An attacker can exploit this remotely without needing any login credentials, potentially compromising the entire server's integrity and confidentiality.

Vendors: PHP.

Quick answers

Is CVE-1999-0068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0068 being exploited in the wild.
How severe is CVE-1999-0068?: High severity, with a CVSS score of 7.5, published 19 October 1997.
Which products and versions are affected?: PHP mylog script.
Is there a fix for CVE-1999-0068?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0068 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-1999-0068?: Check whether you run PHP Mylog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The PHP mylog script is vulnerable to an arbitrary file disclosure vulnerability, likely due to insufficient validation of user-supplied input used in file system operations. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to the script, specifying the path of a file they wish to read (such as /etc/passwd). This allows for the retrieval of sensitive information from the server's filesystem. The vulnerability is exploited over the network via the CGI interface and does not require user interaction.

Affected products

PHP mylog script

Timeline

1997-10-19: disclosed: Initial publication date in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.