CVE-2011-4963: Medium severity nginx vulnerability
Published Jul 26, 2012
·Updated
nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$indexallocation" sequences in a request.
Affected Software
3 affected components
F5 Nginx>=0.7.52<1.2.1
F5 Nginx=1.3.0
Microsoft Windows
Event History
Jul 26, 2012
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
07:55 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-4963?
CVE-2011-4963 is classified as a medium severity vulnerability.
2
How can I mitigate CVE-2011-4963?
To mitigate CVE-2011-4963, upgrade nginx to version 1.3.1 or later, or 1.2.1 or later.
3
What types of attacks does CVE-2011-4963 allow?
CVE-2011-4963 allows remote attackers to bypass access controls and access restricted files.
4
Which versions of nginx are affected by CVE-2011-4963?
CVE-2011-4963 affects nginx versions before 1.3.1 and 1.2.1, specifically 1.3.0 and earlier.
5
Can CVE-2011-4963 affect Windows installations of nginx?
Yes, CVE-2011-4963 can affect nginx installations running on Windows versions prior to the security updates.