CVE-2011-4963

MEDIUM severity · CVSS 5

5CVSS MEDIUM

Summary

nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products we track (1)

Nginx

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.htmlAdvisory
http://nginx.org/en/security_advisories.htmlAdvisory
http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.htmlAdvisory
http://nginx.org/en/security_advisories.htmlAdvisory
http://english.securitylab.ru/lab/PT-2012-06Advisory
http://english.securitylab.ru/lab/PT-2012-06Advisory