CVEvulnerability
CVE-2008-4359
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-10-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-200
Description
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
Affected configurations
• lighttpd lighttpd (< 1.4.20)
• debian debian linux 4.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html Third Party Advisory
- http://openwall.com/lists/oss-security/2008/09/30/1 Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/2 Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/3 Mailing List
- http://secunia.com/advisories/32069 Third Party Advisory
- http://secunia.com/advisories/32132 Third Party Advisory
- http://secunia.com/advisories/32480 Third Party Advisory
- http://secunia.com/advisories/32834 Third Party Advisory
- http://secunia.com/advisories/32972 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200812-04.xml Third Party Advisory
- http://trac.lighttpd.net/trac/changeset/2278 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2307 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2309 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2310 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/ticket/1720 Vendor Advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0309 Third Party Advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1645 Third Party Advisory
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch Patch, Vendor Advisory
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt Vendor Advisory
- http://www.securityfocus.com/archive/1/497932/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31599 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/2741 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690 Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html Third Party Advisory
- http://openwall.com/lists/oss-security/2008/09/30/1 Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/2 Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/3 Mailing List
- http://secunia.com/advisories/32069 Third Party Advisory
- http://secunia.com/advisories/32132 Third Party Advisory
- http://secunia.com/advisories/32480 Third Party Advisory
- http://secunia.com/advisories/32834 Third Party Advisory
- http://secunia.com/advisories/32972 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200812-04.xml Third Party Advisory
- http://trac.lighttpd.net/trac/changeset/2278 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2307 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2309 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2310 Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/ticket/1720 Vendor Advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0309 Third Party Advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1645 Third Party Advisory
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch Patch, Vendor Advisory
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt Vendor Advisory
- http://www.securityfocus.com/archive/1/497932/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31599 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/2741 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690 Third Party Advisory, VDB Entry