CVE-2005-0453

The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source…

published February 16, 2005

CVSS
—
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01716 · 77.1th percentile
Published
2005-02-16T05:00Z
EPSS history
Timeline
  • 16 FEB 05:00Z
    The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source…
    cvelistv5