CVE-2008-1270: Infoleak
moduserdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1270?
CVE-2008-1270 has a medium severity rating, as it allows remote attackers to read arbitrary files on the server.
How do I fix CVE-2008-1270?
To fix CVE-2008-1270, ensure that the userdir.path configuration is set appropriately in lighttpd's configuration file.
What versions of lighttpd are affected by CVE-2008-1270?
CVE-2008-1270 affects lighttpd versions prior to 1.4.19, specifically up to and including version 1.4.18.
What types of attacks can be executed due to CVE-2008-1270?
CVE-2008-1270 can be exploited by attackers to access sensitive files from the ~nobody directory and potentially other user directories.
Is CVE-2008-1270 a configuration error?
Yes, CVE-2008-1270 arises from a misconfiguration when userdir.path is not explicitly set, leading to a default path that may expose files.