Description

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Remediation

References

CVE-2008-1270

Related Vulnerabilities

phpBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-11767)

Serendipity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-1386)

WordPress Plugin Import all XML, CSV & TXT into WordPress Cross-Site Scripting (6.4.2)

WordPress Plugin Social Sharing-Sassy Social Share Cross-Site Scripting (3.3.25)

Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-1611)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2008-1270