CVE-2008-1270
EPSS 8.8%lighttpd - arbitrary file disclosure
發布日:2008/3/10修改日:2026/4/28
描述
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.
受影響套件(2)
- Debian/lighttpdfrom 0, < 1.4.19-1
- Debian/lighttpdfrom 0, < 1.4.13-4etch6