Description
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Remediation
References
Related Vulnerabilities
XWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-41932)
WordPress Plugin Subscribe Form Remote Command Execution (1.1)
Squid Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2025-62168)
WordPress Plugin Coming Soon Page & Maintenance Mode Cross-Site Request Forgery (1.7.8)