CVE-2005-0453: Medium severity Lighttpd Lighttpd vulnerability
Published Feb 16, 2005
·Updated
The bufferurldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
Affected Software
1 affected component
Lighttpd Lighttpd=1.3.7
Remediation
Patch Available
Patch Available
Patch Available
Event History
Feb 16, 2005
CVE Published
05:00 AM
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0453?
CVE-2005-0453 has a medium severity rating due to its potential for information disclosure.
2
How do I fix CVE-2005-0453?
To address CVE-2005-0453, upgrade to Lighttpd version 1.3.8 or later, which resolves this vulnerability.
3
What impact does CVE-2005-0453 have on users?
CVE-2005-0453 can allow remote attackers to access the source code of CGI and FastCGI scripts, posing a risk to sensitive information.
4
Which versions of Lighttpd are affected by CVE-2005-0453?
CVE-2005-0453 affects Lighttpd version 1.3.7 and earlier.
5
Can CVE-2005-0453 be exploited remotely?
Yes, CVE-2005-0453 can be exploited remotely via specially crafted URLs containing a null character.