CVE-2011-4963

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-07-26 · updated 2026-06-16

Description

nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.

Affected products

nginx: from 0.7.52 before 1.2.1; 1.3.0 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: nginx 1.2.1. Check the vendor advisory for mitigations.

References

http://english.securitylab.ru/lab/PT-2012-06
http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.html
http://nginx.org/en/security_advisories.html
http://english.securitylab.ru/lab/PT-2012-06
http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.html
http://nginx.org/en/security_advisories.html

Get alerted when CVE-2011-4963 or the next vulnerability affects your stack