CVEvulnerability
CVE-2005-0453
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2005-02-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Description
The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
Affected configurations
• lighttpd lighttpd 1.3.7
References
- http://article.gmane.org/gmane.comp.web.lighttpd/1171 Patch, Vendor Advisory
- http://secunia.com/advisories/14297 Patch, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200502-21.xml Patch, Vendor Advisory
- http://article.gmane.org/gmane.comp.web.lighttpd/1171 Patch, Vendor Advisory
- http://secunia.com/advisories/14297 Patch, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200502-21.xml Patch, Vendor Advisory