CVE-2014-2324
Medium
Description
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Lighttpd
PublishedMar 14, 2014
First seenMar 14, 2014
How to fix
Update
- lighttpd lighttpd1.4.35 or later
- contec sv-cpt-mc310_firmware6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lighttpd lighttpd | v < 1.4.35 | 1.4.35 |
| debian debian_linux | 6.0, 7.0, 8.0 | — |
| opensuse opensuse | 11.4, 12.3, 13.1 | — |
| suse linux_enterprise_high_availability_extension | 11 | — |
| suse linux_enterprise_software_development_kit | 11 | — |
| contec sv-cpt-mc310_firmware | v < 6.5 | 6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.