Description

mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.

Remediation

References

CVE-2008-4360

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3387)

WordPress Plugin 3D Slider Slice Box Multiple Cross-Site Scripting Vulnerabilities (1.0)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-68951)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2014-3581)

WordPress Plugin Top Quark Architecture 'script.php' Arbitrary File Upload (2.1.0)

Severity

High

Classification

CVE-2008-4360 CWE-200

Tags

Missing Update Known Vulnerabilities