CVE-2015-3200
09.06.2015, 14:59
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
| Vendor | Product | Version |
|---|---|---|
| lighttpd | lighttpd | 𝑥 ≤ 1.4.35 |
| hp | virtual_customer_access_system | 𝑥 ≤ 15.07 |
| oracle | solaris | 11.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| lighttpd |
|
References