PT-2007-6663 · Litespeed · Litespeed Web Server

Tr3Mbl3R · Published 2007-10-23 · Updated 2017-09-29 · CVE-2007-5654

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server versions prior to 3.2.4

Description The issue allows remote attackers to trigger the use of an arbitrary MIME type for a file. This can be achieved by including a "%00." sequence followed by a new extension in a request. For example, an attacker could read PHP source code by requesting .php%00.txt files.

Recommendations For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5654

Affected Products

Litespeed Web Server

References · 8

• 🔥 https://exploit-db.com/exploits/4556 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5654 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5654 · Note
• http://securityfocus.com/bid/26163 · Note
• http://secunia.com/advisories/27302 · Note
• http://osvdb.org/41867 · Note
• http://litespeedtech.com/latest/litespeed-web-server-3.2.4-released.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37380 · Note