Vulnerability Details CVE-2008-4359
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.3%
CVSS Severity
CVSS v2 Score 7.5
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://openwall.com/lists/oss-security/2008/09/30/1
- http://openwall.com/lists/oss-security/2008/09/30/2
- http://openwall.com/lists/oss-security/2008/09/30/3
- http://secunia.com/advisories/32069
- http://secunia.com/advisories/32132
- http://secunia.com/advisories/32480
- http://secunia.com/advisories/32834
- http://secunia.com/advisories/32972
- http://security.gentoo.org/glsa/glsa-200812-04.xml
- http://trac.lighttpd.net/trac/changeset/2278
- http://trac.lighttpd.net/trac/changeset/2307
- http://trac.lighttpd.net/trac/changeset/2309
- http://trac.lighttpd.net/trac/changeset/2310
- http://trac.lighttpd.net/trac/ticket/1720
- http://wiki.rpath.com/Advisories:rPSA-2008-0309
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309
- http://www.debian.org/security/2008/dsa-1645
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt
- http://www.securityfocus.com/archive/1/497932/100/0/threaded
- http://www.securityfocus.com/bid/31599
- http://www.vupen.com/english/advisories/2008/2741
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://openwall.com/lists/oss-security/2008/09/30/1
- http://openwall.com/lists/oss-security/2008/09/30/2
- http://openwall.com/lists/oss-security/2008/09/30/3
- http://secunia.com/advisories/32069
- http://secunia.com/advisories/32132
- http://secunia.com/advisories/32480
- http://secunia.com/advisories/32834
- http://secunia.com/advisories/32972
- http://security.gentoo.org/glsa/glsa-200812-04.xml
- http://trac.lighttpd.net/trac/changeset/2278
- http://trac.lighttpd.net/trac/changeset/2307
- http://trac.lighttpd.net/trac/changeset/2309
- http://trac.lighttpd.net/trac/changeset/2310
- http://trac.lighttpd.net/trac/ticket/1720
- http://wiki.rpath.com/Advisories:rPSA-2008-0309
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309
- http://www.debian.org/security/2008/dsa-1645
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt
- http://www.securityfocus.com/archive/1/497932/100/0/threaded
- http://www.securityfocus.com/bid/31599
- http://www.vupen.com/english/advisories/2008/2741
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690
Products affected by CVE-2008-4359
-
cpe:2.3:a:lighttpd:lighttpd:1.3.11
-
cpe:2.3:a:lighttpd:lighttpd:1.3.12
-
cpe:2.3:a:lighttpd:lighttpd:1.3.13
-
cpe:2.3:a:lighttpd:lighttpd:1.3.14
-
cpe:2.3:a:lighttpd:lighttpd:1.3.15
-
cpe:2.3:a:lighttpd:lighttpd:1.3.16
-
cpe:2.3:a:lighttpd:lighttpd:1.4.1
-
cpe:2.3:a:lighttpd:lighttpd:1.4.10
-
cpe:2.3:a:lighttpd:lighttpd:1.4.11
-
cpe:2.3:a:lighttpd:lighttpd:1.4.12
-
cpe:2.3:a:lighttpd:lighttpd:1.4.13
-
cpe:2.3:a:lighttpd:lighttpd:1.4.14
-
cpe:2.3:a:lighttpd:lighttpd:1.4.15
-
cpe:2.3:a:lighttpd:lighttpd:1.4.16
-
cpe:2.3:a:lighttpd:lighttpd:1.4.17
-
cpe:2.3:a:lighttpd:lighttpd:1.4.18
-
cpe:2.3:a:lighttpd:lighttpd:1.4.19
-
cpe:2.3:a:lighttpd:lighttpd:1.4.2
-
cpe:2.3:a:lighttpd:lighttpd:1.4.3
-
cpe:2.3:a:lighttpd:lighttpd:1.4.4
-
cpe:2.3:a:lighttpd:lighttpd:1.4.5
-
cpe:2.3:a:lighttpd:lighttpd:1.4.6
-
cpe:2.3:a:lighttpd:lighttpd:1.4.7
-
cpe:2.3:a:lighttpd:lighttpd:1.4.8
-
cpe:2.3:a:lighttpd:lighttpd:1.4.9
-
cpe:2.3:o:debian:debian_linux:4.0