CVE-2013-4508

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txtExploit, Mitigation, Vendor Advisory
http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141576815022399&w=2Issue Tracking, Third Party Advisory
http://openwall.com/lists/oss-security/2013/11/04/19Mailing List, Third Party Advisory
http://redmine.lighttpd.net/issues/2525Issue Tracking, Vendor Advisory
http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/Broken Link
https://www.debian.org/security/2013/dsa-2795Third Party Advisory
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txtExploit, Mitigation, Vendor Advisory
http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141576815022399&w=2Issue Tracking, Third Party Advisory
http://openwall.com/lists/oss-security/2013/11/04/19Mailing List, Third Party Advisory
http://redmine.lighttpd.net/issues/2525Issue Tracking, Vendor Advisory
http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/Broken Link
https://www.debian.org/security/2013/dsa-2795Third Party Advisory

Timeline

Published: Nov 8, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-45091.9The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, d CVE-2013-45107.8Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write CVE-2013-45116.9Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memo CVE-2013-45124.7Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause CVE-2013-45134.9Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause CVE-2013-45144.7Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of ser CVE-2013-45154.9The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, w CVE-2013-45164.9The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure CVE-2013-45174.3Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory CVE-2013-45185.5RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates CVE-2013-45194.3Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to in CVE-2013-45204.3xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD,