Is CVE-1999-0346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0346 being exploited in the wild.

How severe is CVE-1999-0346?

Medium severity, with a CVSS score of 5, published 16 October 1997.

Is there a fix for CVE-1999-0346?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0346 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-1999-0346?

Check whether you run Php Fi or PHP mlog script Mlog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0346: PHP mlog script arbitrary file disclosure

CVE-1999-0346 · Severity: medium · CVSS 5 · Published 1997-10-16

A vulnerability exists in the mlog script, a component used in early PHP-based web environments. An attacker can exploit this flaw to view any file stored on the web server, including sensitive configuration files or system data. This could lead to the exposure of private information and provide a foothold for further attacks on the organization's infrastructure.

Vendors: PHP.

Quick answers

Is CVE-1999-0346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0346 being exploited in the wild.
How severe is CVE-1999-0346?: Medium severity, with a CVSS score of 5, published 16 October 1997.
Which products and versions are affected?: PHP mlog script.
Is there a fix for CVE-1999-0346?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0346 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-1999-0346?: Check whether you run Php Fi or PHP mlog script Mlog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mlog script, running as a CGI application in PHP environments, fails to properly validate user-supplied input used in file path operations. This results in an arbitrary file disclosure vulnerability, likely via path traversal or direct parameter manipulation. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to the mlog script, specifying the path of a file they wish to retrieve. Successful exploitation allows the attacker to read any file that the web server process has permissions to access, such as /etc/passwd or application source code.

Affected products

PHP mlog script

Timeline

1997-10-16: disclosed: NVD Published Date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.