CVE-2008-1270

Published: Mar 10, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Affected (1)

Products: Lighttpd: Lighttpd

Lighttpd

1 product

Lighttpd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Up to 1.4.18

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html

Source: cve@mitre.org

http://secunia.com/advisories/29318

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29403

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29622

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29636

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200804-08.xml

Source: cve@mitre.org

http://trac.lighttpd.net/trac/ticket/1587

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1521

Source: cve@mitre.org

http://www.lighttpd.net/2008/3/10/1-4-19-made-in-germany

Source: cve@mitre.org

http://www.lighttpd.net/security/lighttpd_sa_2008_03.txt

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/489465/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28226

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0885/references

Source: cve@mitre.org

https://bugs.gentoo.org/show_bug.cgi?id=212930

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/41173

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-2344

Source: cve@mitre.org

Exploit

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html