CVE-2008-1270: lighttpd

EPSS trend

Probability

11.90%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 11.90% on 21-09-2026

21-09-202621-10-2026

EPSS score

11.90%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (issues.rpath.com)
Maturity: unknown
exploit-databaseremotelinuxVerified
Lighttpd 1.4.x - mod_userdir Information Disclosure
Maturity: weaponized

References

18 links

issues.rpath.com/browse/RPL-2344X Refsource CONFIRMExploit
secunia.com/advisories/29622Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29318Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.htmlVendor AdvisoryX Refsource SUSE
security.gentoo.org/glsa/glsa-200804-08.xmlVendor AdvisoryX Refsource GENTOO
www.debian.org/security/2008/dsa-1521Vendor AdvisoryX Refsource DEBIAN
www.lighttpd.net/security/lighttpd_sa_2008_03.txtX Refsource CONFIRM
www.securityfocus.com/archive/1/489465/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29636Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/0885/referencesVDB EntryX Refsource VUPEN

Show all 18 references

www.securityfocus.com/bid/28226VDB EntryX Refsource BID
trac.lighttpd.net/trac/ticket/1587X Refsource CONFIRM
secunia.com/advisories/29403Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.lighttpd.net/2008/3/10/1-4-19-made-in-germanyX Refsource CONFIRM
bugs.gentoo.org/show_bug.cgi?id=212930X Refsource CONFIRM
wiki.rpath.com/wiki/Advisories:rPSA-2008-0106X Refsource MISC
exchange.xforce.ibmcloud.com/vulnerabilities/41173VDB EntryX Refsource XF
security-tracker.debian.org/tracker/CVE-2008-1270Advisory

Related vulnerabilities

CVE-2018-19052debianlighttpd+1013.71%7y ago07-11-2018 05:00An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.CVE-2018-25103debianlighttpd+20.67%2y ago17-06-2024 18:02There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.CVE-2013-1427debianlighttpd+20.35%13y ago21-03-2013 17:00The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.CVE-2013-4560debianlighttpd+45.42%12y ago19-11-2013 19:00Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.CVE-2013-4508debianlighttpd+42.63%12y ago08-11-2013 02:00lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.CVE-2013-4559debianlighttpd+410.72%12y ago19-11-2013 19:00lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

All vulnerabilities inlighttpd

CVE-2008-1270: lighttpd

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References