CVE-2005-0453
The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
- Score
- CVSS 2.0 5.0 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2005-02-16
- Last modified
- 2024-08-07
Affected products
References
- http://article.gmane.org/gmane.comp.web.lighttpd/1171
- http://secunia.com/advisories/14297
- http://security.gentoo.org/glsa/glsa-200502-21.xml
