CVE-2002-2288: Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP requ...

Security readout for executives and security teams

This CVE is an information disclosure issue in Mambo Site Server 4.0.11. A crafted request can make the application reveal the server’s physical filesystem path in an error message. That does not by itself prove system compromise, but it can help an attacker map the environment for later attacks. Exposure is most likely where legacy Mambo Site Server 4.0.11 remains reachable over HTTP. The bundle lists affected vendor and product fields as n/a, so asset owners should confirm exposure by inventory and version evidence rather than CPE matching alone. Treat this as low urgency unless legacy Mambo is still internet-facing or already under suspicious probing. The main business action is to find and remove unsupported exposure, because obsolete web platforms often carry broader unmeasured risk. Mitigation focus: Identify and retire any internet-facing Mambo Site Server 4.0.11 instances.; Check vendor or project guidance for supported upgrade or configuration fixes.; Ensure production error pages do not reveal filesystem paths..

Prepared

Jun 29, 2026, 02:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.