PT-2015-6091 · Lighttpd+3 · Lighttpd+3

Published 2015-05-25 · Updated 2021-03-15 · CVE-2015-3200

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions lighttpd versions prior to 1.4.36

Description The issue allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character. This can be achieved by using a string containing a NULL and new line character in the authentication string.

Recommendations For versions prior to 1.4.36, update to version 1.4.36 or later to resolve the issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2015-1640

BDU:2025-16007

CVE-2015-3200

MGASA-2015-0338

SUSE-SU-2017:0728-1

SUSE-SU-2017:0731-1

SUSE-SU-2017_0728-1

SUSE-SU-2017_0731-1

USN-4775-1

Affected Products

Alt Linux

Lighttpd

Suse

Ubuntu

References · 50

• 🔥 http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3200 · Security Note
• http://redmine.lighttpd.net/issues/2646 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1640 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19052 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0338 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0338.html · Security Note
• https://bdu.fstec.ru/vul/2020-02904 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16007 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3200 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-3200 · Security Note