Description
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
Metrics
CVSS 2.0 7.5/10
AV:N/AC:L/Au:N/C:P/I:P/A:PWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlThird Party Advisory
- http://openwall.com/lists/oss-security/2008/09/30/1Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/2Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/3Mailing List
- http://secunia.com/advisories/32069Third Party Advisory
- http://secunia.com/advisories/32132Third Party Advisory
- http://secunia.com/advisories/32480Third Party Advisory
- http://secunia.com/advisories/32834Third Party Advisory
- http://secunia.com/advisories/32972Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200812-04.xmlThird Party Advisory
- http://trac.lighttpd.net/trac/changeset/2278Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2307Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2309Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2310Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/ticket/1720Vendor Advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0309Third Party Advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309Third Party Advisory
- http://www.debian.org/security/2008/dsa-1645Third Party Advisory
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patchPatch, Vendor Advisory
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txtVendor Advisory
- http://www.securityfocus.com/archive/1/497932/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31599Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/2741Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlThird Party Advisory
- http://openwall.com/lists/oss-security/2008/09/30/1Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/2Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/3Mailing List
- http://secunia.com/advisories/32069Third Party Advisory
- http://secunia.com/advisories/32132Third Party Advisory
- http://secunia.com/advisories/32480Third Party Advisory
- http://secunia.com/advisories/32834Third Party Advisory
- http://secunia.com/advisories/32972Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200812-04.xmlThird Party Advisory
- http://trac.lighttpd.net/trac/changeset/2278Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2307Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2309Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/changeset/2310Broken Link, Vendor Advisory
- http://trac.lighttpd.net/trac/ticket/1720Vendor Advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0309Third Party Advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309Third Party Advisory
- http://www.debian.org/security/2008/dsa-1645Third Party Advisory
- http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patchPatch, Vendor Advisory
- http://www.lighttpd.net/security/lighttpd_sa_2008_05.txtVendor Advisory
- http://www.securityfocus.com/archive/1/497932/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31599Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/2741Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45690Third Party Advisory, VDB Entry
Timeline
- Published
- Oct 3, 2008
- Last modified
- Jun 16, 2026
- NVD status
- Modified