CVE-2008-1111

Published: Mar 4, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.

Affected (1)

Products: Lighttpd: Lighttpd

Lighttpd

1 product

Lighttpd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Version 1.4.18

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (38)

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html

Source: cve@mitre.org

http://secunia.com/advisories/29209

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29235

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29268

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29275

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29318

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29622

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-10.xml

Source: cve@mitre.org

http://trac.lighttpd.net/trac/changeset/2107

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1513

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/489465/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28100

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0763

Source: cve@mitre.org

Vendor Advisory

https://bugs.gentoo.org/show_bug.cgi?id=211956

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/41008

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-2326

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html