CVE-2010-2263

MEDIUM severity · CVSS 5 · Information disclosure

5CVSS MEDIUM

Summary

nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)44%

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products we track (1)

Nginx

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.htmlAdvisory
http://www.exploit-db.com/exploits/13818Advisory
http://www.exploit-db.com/exploits/13822Advisory
http://www.securityfocus.com/bid/40760Advisory
http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.htmlAdvisory
http://www.exploit-db.com/exploits/13818Advisory
http://www.exploit-db.com/exploits/13822Advisory
http://www.securityfocus.com/bid/40760Advisory