CVE-2014-2323
Critical
Description
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Lighttpd
PublishedMar 14, 2014
First seenMar 14, 2014
How to fix
Update
- lighttpd lighttpd1.4.35 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lighttpd lighttpd | v < 1.4.35 | 1.4.35 |
| debian debian_linux | 6.0, 7.0, 8.0 | — |
| opensuse opensuse | 11.4, 12.3, 13.1 | — |
| suse linux_enterprise_high_availability_extension | 11 | — |
| suse linux_enterprise_software_development_kit | 11 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.