lighttpd < 1.4.20 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 4698


The remote web server may be affected by several issues.


According to its banner, the version of lighttpd installed on the remote host is older than 1.4.20. Such versions may be affected by several issues, including :

- SSL connections could be shut down by a remote attacker.
- URL rewrite and redirect patterns can be circumvented by encoding.
- mod_userdir does not sanitize URLs, which could lead to an information disclosure on case insensitive file systems e.g. would get the source code of file.php, instead of running the script.
- The server leaks memory when it processes duplicate headers. This could lead to a denial of service by resource exhaustion.


Upgrade to version 1.4.20 or higher.

See Also

Plugin Details

Severity: Medium

ID: 4698

Family: Web Servers

Published: 2008/10/03

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 34332

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 5.3

Temporal Score: 4.9


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:lighttpd:lighttpd

Reference Information

CVE: CVE-2008-1531, CVE-2008-4359, CVE-2008-4360, CVE-2008-4298

BID: 28489, 31434, 31599, 31600