CVE-2008-4359

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-10-03 · updated 2026-06-16
Weakness: CWE-200

Description

lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.

Affected products

Debian Linux: 4.0
lighttpd: before 1.4.20 — fixed in 1.4.20

How to fix

Upgrade to a fixed version: lighttpd 1.4.20. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://openwall.com/lists/oss-security/2008/09/30/1
http://openwall.com/lists/oss-security/2008/09/30/2
http://openwall.com/lists/oss-security/2008/09/30/3
http://secunia.com/advisories/32069
http://secunia.com/advisories/32132
http://secunia.com/advisories/32480
http://secunia.com/advisories/32834
http://secunia.com/advisories/32972
http://security.gentoo.org/glsa/glsa-200812-04.xml
http://trac.lighttpd.net/trac/changeset/2278
http://trac.lighttpd.net/trac/changeset/2307

Get alerted when CVE-2008-4359 or the next vulnerability affects your stack