CVE-2013-4547

Published: Nov 23, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

Affected (9)

Products: F5: Nginx · Opensuse: Opensuse · Suse: Lifecycle Management Server, Studio Onsite, Webyast

1 product

1 product

3 products

Lifecycle Management Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx	From 0.8.41 to 1.4.4
F5 Nginx	From 1.5.0 to 1.5.6

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.2
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1
Suse Lifecycle Management Server	Version 1.3
Suse Studio Onsite	Version 1.3
Suse Webyast	Version 1.3

Related CWEs

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (18)

http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html

Source: secalert@redhat.com

MitigationVendor Advisory

http://secunia.com/advisories/55757

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/55822

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/55825

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2012/dsa-2802

Source: secalert@redhat.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

http://secunia.com/advisories/55757

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/55822

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/55825

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2012/dsa-2802

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.