CVE-2013-1427

Published: Mar 21, 2013Modified: Apr 29, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.

Affected (24)

Products: Lighttpd: Lighttpd

Lighttpd

1 product

Lighttpd

Configuration A

24 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Up to 1.4.27
Lighttpd Lighttpd	Version 1.3.16
Lighttpd Lighttpd	Version 1.4.10
Lighttpd Lighttpd	Version 1.4.11
Lighttpd Lighttpd	Version 1.4.12
Lighttpd Lighttpd	Version 1.4.13
Lighttpd Lighttpd	Version 1.4.15
Lighttpd Lighttpd	Version 1.4.16
Lighttpd Lighttpd	Version 1.4.18
Lighttpd Lighttpd	Version 1.4.19
Lighttpd Lighttpd	Version 1.4.20
Lighttpd Lighttpd	Version 1.4.21
Lighttpd Lighttpd	Version 1.4.22
Lighttpd Lighttpd	Version 1.4.23
Lighttpd Lighttpd	Version 1.4.24
Lighttpd Lighttpd	Version 1.4.25
Lighttpd Lighttpd	Version 1.4.26
Lighttpd Lighttpd	Version 1.4.3
Lighttpd Lighttpd	Version 1.4.4
Lighttpd Lighttpd	Version 1.4.5
Lighttpd Lighttpd	Version 1.4.6
Lighttpd Lighttpd	Version 1.4.7
Lighttpd Lighttpd	Version 1.4.8
Lighttpd Lighttpd	Version 1.4.9