CVE-2008-4360: debian debian_linux
Vulnerability summary
CVE-2008-4360 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 4.35% chance of exploitation in the next 30 days, higher than 91.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 03-10-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.35%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.35% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- lighttpd< 1.4.19-5
- debian_linuxEOL4.0
Lighttpd1 product
- lighttpd< 1.4.20
2 vendors · 3 products
References
23 links- www.lighttpd.net/security/lighttpd-1.4.x_userdir_lowercase.patchX Refsource CONFIRMPatchVendor Advisory
Show all 23 references
- www.securityfocus.com/archive/1/497932/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory