CVE-2008-0408

Published: Jan 29, 2008Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.

Affected (1)

Products: Hfs: Http File Server

Hfs

1 product

Http File Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hfs Http File Server	Up to 2.2b

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (16)

http://secunia.com/advisories/28631

Source: cve@mitre.org

http://securityreason.com/securityalert/3582

Source: cve@mitre.org

http://www.rejetto.com/hfs/?f=wn

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/486874/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27423

Source: cve@mitre.org

http://www.syhunt.com/advisories/hfs-1-username.txt

Source: cve@mitre.org

http://www.syhunt.com/advisories/hfshack.txt

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39876

Source: cve@mitre.org

http://secunia.com/advisories/28631