Published: 23/11/2013 Updated: 10/11/2021

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

nginx 0.8.41 up to and including 1.4.3 and 1.5.x prior to 1.5.7 allows remote malicious users to bypass intended restrictions via an unescaped space character in a URI.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 nginx
suse lifecycle management server 1.3
suse studio onsite 1.3
suse webyast 1.3
opensuse opensuse 11.4
opensuse opensuse 12.2
opensuse opensuse 12.3
opensuse opensuse 13.1

Ivan Fratric of the Google Security Team discovered a bug in nginx, a web server, which might allow an attacker to bypass security restrictions by using a specially crafted request The oldstable distribution (squeeze) is not affected by this problem For the stable distribution (wheezy), this problem has been fixed in version 121-22+wheezy2 Fo ...

Debian Bug report logs - #730012 nginx: CVE-2013-4547 Package: nginx; Maintainer for nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Source for nginx is src:nginx (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 20 Nov 2013 06:12:02 UTC Severit ...

Debian Bug report logs - #761940 nginx:CVE-2014-3616: possible to reuse cached SSL sessions in unrelated contexts Package: src:nginx; Maintainer for src:nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 17 Sep 2014 05:09: ...

nginx 0841 through 143 and 15x before 157 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI ...

source: wwwsecurityfocuscom/bid/63814/info nginx is prone to a remote security-bypass vulnerability An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions nginx 0841 through 156 are vulnerable The following example data is available: /file \0php ...

Nginx 文件名逻辑漏洞（CVE-2013-4547）漏洞说明影响版本：Nginx 0841 ~ 143 / 150 ~ 157 参考链接： cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2013-4547 blogwernerwiki/file-resolution-vulnerability-nginx/ www91riorg/9064html 漏洞说明这个漏洞其实和代码执行没有太大关系，其主要原因是错误地解�

CWE-116 http://www.debian.org/security/2012/dsa-2802 http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.html http://secunia.com/advisories/55757 http://secunia.com/advisories/55825 http://secunia.com/advisories/55822 http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.html http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.html https://nvd.nist.gov https://www.debian.org/security/./dsa-2802 https://www.exploit-db.com/exploits/38846/

CVE-2013-4547

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect