Description

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Remediation

References

CVE-2008-1270

Related Vulnerabilities

XWiki Other Vulnerability (CVE-2022-36090)

Joomla! Core 3.x.x Security Bypass (3.0.0 - 3.4.4)

Oracle Application Server CVE-2009-1008 Vulnerability (CVE-2009-1008)

Oracle Database Server Other Vulnerability (CVE-2006-1869)

WordPress Plugin Greenshift-animation and page builder blocks Cross-Site Scripting (4.8.8)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2008-1270