CVE-2015-3200: High severity fipsasp fipscms light vulnerability
Published Jun 9, 2015
·Updated
modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Affected Software
3 affected components
Lighttpd Lighttpd<=1.4.35
HP Virtual Customer Access System<=15.07
Oracle Solaris=11.3
Event History
Jun 9, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3200?
CVE-2015-3200 is classified as a medium severity vulnerability due to its potential for log injection.
2
How do I fix CVE-2015-3200?
To fix CVE-2015-3200, upgrade lighttpd to version 1.4.36 or later.
3
What systems are affected by CVE-2015-3200?
CVE-2015-3200 affects lighttpd versions prior to 1.4.36, HP Virtual Customer Access System 15.07, and Oracle Solaris 11.3.
4
What type of attack does CVE-2015-3200 enable?
CVE-2015-3200 enables remote attackers to inject arbitrary log entries.
5
Is CVE-2015-3200 related to HTTP authentication?
Yes, CVE-2015-3200 is related to basic HTTP authentication and allows for log injection via specially crafted authentication strings.