Detections
Analytics
CVE-2008-4359
medium
Description
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/45690
http://www.vupen.com/english/advisories/2008/2741
http://www.securityfocus.com/bid/31599
http://www.securityfocus.com/archive/1/497932/100/0/threaded
http://www.debian.org/security/2008/dsa-1645
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309
http://wiki.rpath.com/Advisories:rPSA-2008-0309
http://security.gentoo.org/glsa/glsa-200812-04.xml
http://secunia.com/advisories/32972
http://secunia.com/advisories/32834
http://secunia.com/advisories/32480
http://secunia.com/advisories/32132
http://secunia.com/advisories/32069
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-4340
http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt
http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch
http://trac.lighttpd.net/trac/ticket/1720
http://trac.lighttpd.net/trac/changeset/2310
http://trac.lighttpd.net/trac/changeset/2309
http://trac.lighttpd.net/trac/changeset/2307
http://trac.lighttpd.net/trac/changeset/2278
http://openwall.com/lists/oss-security/2008/09/30/3