Description

lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.

Remediation

References

CVE-2008-4359

Related Vulnerabilities

WordPress Plugin Events Manager Extended 'admin.php' SQL Injection (3.1.2)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9188)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0276)

WordPress Plugin Widget for Facebook Page Feeds Cross-Site Scripting (5.0)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-2422)

Severity

High

Classification

CVE-2008-4359 CWE-200

Tags

Missing Update Known Vulnerabilities