lighttpd < 1.4.35 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 8159


The remote server is running a version of lighttpd that is unpatched for multiple vulnerabilities.


Versions older than 1.4.35 are vulnerable to the following issues:

- Insufficient user input sanitation on the hostname in the 'mod_mysql_vhost' module could be leveraged for a SQL injection attack (CVE-2014-2323)

- Insufficient user input sanitation on the hostname in 'mod_evhost' and 'mod_simple_vhost' modules could be leveraged for directory traversal attacks (CVE-2014-2324)


Update lighttpd to version 1.4.35 or later.

See Also

Plugin Details

Severity: Medium

ID: 8159

File Name: 8159.prm

Family: Web Servers

Published: 2014/03/13

Modified: 2016/01/30

Dependencies: 1442

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C


Base Score: 4

Temporal Score: 3.5


Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:lighttpd:lighttpd

Patch Publication Date: 2014/03/12

Vulnerability Publication Date: 2014/03/12

Reference Information

CVE: CVE-2014-2323, CVE-2014-2324

BID: 66153, 66157