PT-2008-5609 · Lighttpd · Lighttpd

Gaetan.Bisson · Published 2008-10-03 · Updated 2024-06-15 · CVE-2008-4359

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: lighttpd versions prior to 1.4.20

Description: The issue allows remote attackers to bypass intended access restrictions, obtain sensitive information, or possibly modify data. This is due to lighttpd comparing URIs to patterns in the url.redirect and url.rewrite configuration settings before performing URL decoding.

Recommendations: For versions prior to 1.4.20, update to version 1.4.20 or later to resolve the issue. As a temporary workaround, consider reviewing and adjusting the url.redirect and url.rewrite configuration settings to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4359

DSA-1645-1

OPENSUSE-SU-2024:10585-1

Affected Products

Lighttpd

References · 40

• http://trac.lighttpd.net/trac/changeset/2309 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10585-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1645 · Vendor Advisory
• http://trac.lighttpd.net/trac/changeset/2307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4359 · Security Note
• http://lighttpd.net/security/lighttpd_sa_2008_05.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-4359 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-4359 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-04.xml · Vendor Advisory
• http://trac.lighttpd.net/trac/changeset/2310 · Vendor Advisory
• http://lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4359 · Vendor Advisory
• http://trac.lighttpd.net/trac/ticket/1720 · Vendor Advisory
• http://trac.lighttpd.net/trac/changeset/2278 · Vendor Advisory