// For flags

CVE-2019-11072

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.

** EN DISPUTA ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTA: El desarrollador afirma "La característica que puede ser abusada para causar el fallo es una nueva característica en lighttpd 1.4.50, y no está habilitada por defecto. Debe estar configurado explícitamente en el archivo de configuración (por ejemplo, lighttpd.conf). Cierta entrada activará un abort() en lighttpd cuando esa característica esté activada. lighttpd detecta que el underflow o realloc() fallará (tanto en ejecutables de 32 bits como en ejecutables de 64 bits), también detectado en lighttpd. O bien desencadena un abort() explícito por parte de lighttpd. Esto no es explotable más allá de activar el abort() explícito con la subsiguiente salida de la aplicación".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2019-04-10 CVE Reserved
  • 2019-04-10 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-08-31 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lighttpd
Search vendor "Lighttpd"
Lighttpd
Search vendor "Lighttpd" for product "Lighttpd"
<= 1.4.53
Search vendor "Lighttpd" for product "Lighttpd" and version " <= 1.4.53"
-
Affected