Vulnerability in Lighttpd

CVE-2005-0453

The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

EPSS: 0.017 (75.1th percentile) — read the EPSS interpretation.

Affected products

  • Lighttpd — versions 1.3.7
  • N/a — versions n/a

References

  • cve@mitre.org (vendor-advisory, Patch, x_refsource_GENTOO, Vendor Advisory)
  • cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)