CVE-2014-2323

nvd nist nuclei

Published: Mar 14, 2014Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Affected (9)

Products: Lighttpd: Lighttpd · Debian: Debian Linux · Opensuse: Opensuse · +1 more

Show all products

Lighttpd: Lighttpd · Debian: Debian Linux · Opensuse: Opensuse · Suse: Linux Enterprise High Availability Extension, Linux Enterprise Software Development Kit

1 product

1 product

1 product

2 products

Linux Enterprise High Availability Extension

Linux Enterprise Software Development Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Before 1.4.35

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1
Suse Linux Enterprise High Availability Extension	Version 11 sp3
Suse Linux Enterprise Software Development Kit	Version 11 sp3

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (24)

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt

Source: cve@mitre.org

ExploitVendor Advisory

http://jvn.jp/en/jp/JVN37417423/index.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=141576815022399&w=2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q1/561

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q1/564

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/57404

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/57514

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2014/dsa-2877

Source: cve@mitre.org

Third Party Advisory

http://www.lighttpd.net/2014/3/12/1.4.35/

Source: cve@mitre.org

PatchVendor Advisory

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

http://jvn.jp/en/jp/JVN37417423/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=141576815022399&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q1/561

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q1/564

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://secunia.com/advisories/57404

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://secunia.com/advisories/57514

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.debian.org/security/2014/dsa-2877

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.lighttpd.net/2014/3/12/1.4.35/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.