Vulnerability in F5 Nginx
CVE-2011-4963
nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
EPSS: 0.003 (54.5th percentile) — read the EPSS interpretation.
Affected products
- F5 Nginx — versions 1.3.0
- Microsoft Windows
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Mitigation)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- [nginx-announce] 20120605 security advisory (Vendor Advisory, mailing-list, x_refsource_MLIST, Mitigation)
Frequently asked questions
- What is CVE-2011-4963?
- CVE-2011-4963 is a vulnerability in F5 Nginx. Published 2012-07-26.
- Is CVE-2011-4963 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.