CVE-2008-1270

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files…

published March 10, 2008

CVSS
—
EPSS
12%
Percentile
96.1
In the wild
Unconfirmed
What it is

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11900 · 96.1th percentile
Published
2008-03-10T21:00Z
EPSS history
Timeline
  • 10 MAR 21:00Z
    mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files…
    cvelistv5