Back to Database
Status published
Medium
CVE-2014-2324
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost...
Vulnerability Description
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-2324
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.lighttpd.net/2014/3/12/1.4.35/
- http://www.securityfocus.com/bid/66157
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt
- http://www.debian.org/security/2014/dsa-2877
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html
- http://secunia.com/advisories/57514
- http://marc.info/?l=bugtraq&m=141576815022399&w=2
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html
- http://secunia.com/advisories/57404
- http://seclists.org/oss-sec/2014/q1/564
- http://seclists.org/oss-sec/2014/q1/561
- http://jvn.jp/en/jp/JVN37417423/index.html
More from lighttpd
View All →CVE-2025-12642
HTTP Header Smuggling via Trailer Merge
Medium
6.9
CVE-2022-41556
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66...
High
7.5
CVE-2022-37797
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function...
High
7.5
CVE-2022-30780
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause...
High
7.5
CVE-2022-22707
In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the...
Medium
5.9
Affected Vendor
lighttpd
View all reports →Affected Software
lighttpd, debian linux, opensuse, linux enterprise high availability extension, linux enterprise software development kit, sv-cpt-mc310 firmware
Vulnerable Versions:
0, 6.0, 7.0, 8.0, 11.4, 12.3, 13.1, 11
Timeline
Official Publish:
March 14th, 2014
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.