CVE-2004-2628: Medium severity Acme Labs thttpd vulnerability
Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary files via a URL that contains (1) a hex-encoded backslash dot-dot sequence ("%5C..") or (2) a drive letter (such as "C:").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2628?
CVE-2004-2628 is considered a high-severity vulnerability due to its potential for remote file access.
How do I fix CVE-2004-2628?
To fix CVE-2004-2628, upgrade to a newer version of thttpd that does not contain this vulnerability.
What systems are affected by CVE-2004-2628?
CVE-2004-2628 affects thttpd 2.0.7 beta 0.4 when running specifically on Windows systems.
What are the implications of CVE-2004-2628?
The implications of CVE-2004-2628 include the ability for attackers to read arbitrary files from the server, leading to potential information disclosure.
Who is the vendor for CVE-2004-2628?
The vendor for CVE-2004-2628 is Acme Labs, the developer of thttpd.