CVE-2014-2323: SQL Injection
Published Mar 14, 2014
·Updated
SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname.
Affected Software
9 affected components
Lighttpd Lighttpd<1.4.35
Debian Debian Linux=6.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
openSUSE openSUSE=11.4
openSUSE openSUSE=12.3
openSUSE openSUSE=13.1
SUSE Linux Enterprise High Availability Extension=11-sp3
SUSE Linux Enterprise Software Development Kit=11-sp3
Remediation
Patch Available
Event History
Mar 14, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2323?
CVE-2014-2323 is classified as a high severity vulnerability due to the potential for arbitrary SQL command execution.
2
How do I fix CVE-2014-2323?
To fix CVE-2014-2323, upgrade to lighttpd version 1.4.35 or later.
3
What systems are affected by CVE-2014-2323?
CVE-2014-2323 affects lighttpd versions prior to 1.4.35 and certain Debian and openSUSE distributions.
4
Can CVE-2014-2323 lead to data breaches?
Yes, due to the SQL injection nature of CVE-2014-2323, it can potentially lead to data breaches and unauthorized access to sensitive information.
5
Is CVE-2014-2323 the only SQL injection vulnerability in lighttpd?
No, while CVE-2014-2323 is a notable SQL injection vulnerability, there may be other vulnerabilities that also pose risks.