Read the docs
TI-2003-01207 Aliases CVE-2003-1307GHSA-8jm5-c7cw-v9hh

The mod_php module for the Apache HTTP Server allows local users with write access to PHP…

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.

Why it matters now

EPSS 0.01724 77th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*2.0.28VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*2.0.28 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:*2.0.28 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*2.0.32VulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:*2.0.32 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:*2.0.34 betaVulnerableApache
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*2.0.35VulnerableApache
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*2.0.36VulnerableApache
  • cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:* Versions 2.0.28 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:* Versions 2.0.28 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:* Versions 2.0.32 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:* Versions 2.0.34 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Apache
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*2.0.37VulnerableApache
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*2.0.38VulnerableApache
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*2.0.39VulnerableApache
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*2.0.40VulnerableApache
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*2.0.41VulnerableApache
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*2.0.42VulnerableApache
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*2.0.43VulnerableApache
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*2.0.44VulnerableApache
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*2.0.45VulnerableApache
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*2.0.46VulnerableApache
cpe:2.3:a:apache:http_server:2.0.46:*:win32:*:*:*:*:*2.0.46VulnerableApache
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*2.0.47VulnerableApache
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*2.0.48VulnerableApache
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:* Versions 2.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:* Versions 2.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:* Versions 2.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:* Versions 2.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:* Versions 2.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:* Versions 2.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:* Versions 2.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:* Versions 2.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:* Versions 2.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:* Versions 2.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:win32:*:*:*:*:* Versions 2.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:* Versions 2.0.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:* Versions 2.0.48 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-1307
  2. 2026-10-03 Alias added: GHSA-8jm5-c7cw-v9hh

References

Exploit 2

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences