Detections
Analytics
lighttpd < 1.4.35 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 8159
Synopsis
The remote server is running a version of lighttpd that is unpatched for multiple vulnerabilities.Description
Versions older than 1.4.35 are vulnerable to the following issues:- Insufficient user input sanitation on the hostname in the 'mod_mysql_vhost' module could be leveraged for a SQL injection attack (CVE-2014-2323)
- Insufficient user input sanitation on the hostname in 'mod_evhost' and 'mod_simple_vhost' modules could be leveraged for directory traversal attacks (CVE-2014-2324)
Solution
Update lighttpd to version 1.4.35 or later.See Also
http://seclists.org/oss-sec/2014/q1/561
http://seclists.org/oss-sec/2014/q1/564
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt
Plugin Details
Severity: Medium
ID: 8159
Family: Web Servers
Published: 3/13/2014
Updated: 3/6/2019
Nessus ID: 73123
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:lighttpd:lighttpd
Patch Publication Date: 3/12/2014
Vulnerability Publication Date: 3/12/2014
Reference Information
CVE: CVE-2014-2323, CVE-2014-2324