Description
mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.
Remediation
References
Related Vulnerabilities
Magento Incorrect Authorization Vulnerability (CVE-2020-24401)
Liferay DXP Insecure Default Initialization of Resource Vulnerability (CVE-2024-25610)
WordPress Plugin E-Search Multiple Cross-Site Scripting Vulnerabilities (1.0)
Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2021-31618)