mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.
References
Configurations
Information
Published : 2008-03-10 14:44
Updated : 2018-10-11 13:31
NVD link : CVE-2008-1270
Mitre link : CVE-2008-1270
JSON object : View
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Products Affected
lighttpd
- lighttpd