{"schemaVersion":3,"id":"CVE-2008-4359","aliases":["DEBIAN-CVE-2008-4359"],"status":"published","duplicateOf":null,"title":null,"description":"lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.","dates":{"published":"2008-10-03T17:18:00.000Z","modified":"2024-08-07T10:17:08.779Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04345,"percentile":0.91162,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.04345},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.04345,"percentile":0.91162}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04345,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.04345,"percentile":0.91162}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"debian","product":"lighttpd","name":"lighttpd","label":"lighttpd","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/lighttpd","purlType":"deb","versions":[{"text":"< 1.4.19-5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.19-5","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":{"isEol":true,"eolDate":"2010-02-15T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4","label":"4 (Etch)","eolFrom":"2010-02-15T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.0r9"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"lighttpd","product":"lighttpd","name":"lighttpd","label":"lighttpd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.4.20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.20","eol":null,"hubHref":"/vendor/lighttpd/lighttpd"}],"affectedCount":3,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://secunia.com/advisories/32069","label":"secunia.com/advisories/32069","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://trac.lighttpd.net/trac/changeset/2307","label":"trac.lighttpd.net/trac/changeset/2307","hostname":"trac.lighttpd.net","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt","label":"www.lighttpd.net/security/lighttpd_sa_2008_05.txt","hostname":"www.lighttpd.net","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/32972","label":"secunia.com/advisories/32972","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://trac.lighttpd.net/trac/changeset/2278","label":"trac.lighttpd.net/trac/changeset/2278","hostname":"trac.lighttpd.net","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0309","label":"wiki.rpath.com/Advisories:rPSA-2008-0309","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/31599","label":"www.securityfocus.com/bid/31599","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32834","label":"secunia.com/advisories/32834","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://trac.lighttpd.net/trac/ticket/1720","label":"trac.lighttpd.net/trac/ticket/1720","hostname":"trac.lighttpd.net","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://trac.lighttpd.net/trac/changeset/2309","label":"trac.lighttpd.net/trac/changeset/2309","hostname":"trac.lighttpd.net","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309","label":"wiki.rpath.com/wiki/Advisories:rPSA-2008-0309","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32132","label":"secunia.com/advisories/32132","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://openwall.com/lists/oss-security/2008/09/30/1","label":"openwall.com/lists/oss-security/2008/09/30/1","hostname":"openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://www.securityfocus.com/archive/1/497932/100/0/threaded","label":"www.securityfocus.com/archive/1/497932/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Third Party Advisory","VDB Entry"]},{"url":"http://trac.lighttpd.net/trac/changeset/2310","label":"trac.lighttpd.net/trac/changeset/2310","hostname":"trac.lighttpd.net","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/2741","label":"www.vupen.com/english/advisories/2008/2741","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1645","label":"www.debian.org/security/2008/dsa-1645","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2008/09/30/3","label":"openwall.com/lists/oss-security/2008/09/30/3","hostname":"openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45690","label":"exchange.xforce.ibmcloud.com/vulnerabilities/45690","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2008/09/30/2","label":"openwall.com/lists/oss-security/2008/09/30/2","hostname":"openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://secunia.com/advisories/32480","label":"secunia.com/advisories/32480","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch","label":"www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch","hostname":"www.lighttpd.net","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html","label":"lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-200812-04.xml","label":"security.gentoo.org/glsa/glsa-200812-04.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-4359","label":"security-tracker.debian.org/tracker/CVE-2008-4359","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1645-1","OPENSUSE-SU-2024:10585-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10585-1"]},"timeline":[{"kind":"published","date":"2008-10-03T17:18:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T10:17:08.779Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:07:00.549Z","stale":false,"partial":false}}