lighttpd prior to 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote malicious users to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
lighttpd lighttpd |
||
debian debian linux 4.0 |
Vulmon