CVE-2013-4547

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing List, Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigation, Vendor Advisory
http://secunia.com/advisories/55757Third Party Advisory
http://secunia.com/advisories/55822Third Party Advisory
http://secunia.com/advisories/55825Third Party Advisory
http://www.debian.org/security/2012/dsa-2802Broken Link
http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing List, Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigation, Vendor Advisory
http://secunia.com/advisories/55757Third Party Advisory
http://secunia.com/advisories/55822Third Party Advisory
http://secunia.com/advisories/55825Third Party Advisory
http://www.debian.org/security/2012/dsa-2802Broken Link

Timeline

Published: Nov 23, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-45486.0The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initia CVE-2013-45495.0QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Exp CVE-2013-45505.1Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with CVE-2013-45515.7Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, CVE-2013-45527.5lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary CVE-2013-45535.2The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in CVE-2013-45545.2Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercall CVE-2013-45556.8Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the auth CVE-2013-45564.3Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0 CVE-2013-45577.5The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers CVE-2013-45583.5The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through CVE-2013-45597.6lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd