CVE-2014-2324 Path traversal in n/a
Remote attackers can read arbitrary files on lighttpd servers via directory traversal in the host name header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2324?
CVE-2014-2324 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 14 Mar 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
Weakness: CWE-22
Which versions are affected by CVE-2014-2324?
It affects 6 products.
Products include Contec Sv-Cpt-Mc310 Firmware, Debian Debian Linux, Lighttpd Lighttpd, Opensuse Opensuse, Suse Linux Enterprise High Availability Extension, Suse Linux Enterprise Software Development Kit.
How do I fix CVE-2014-2324?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-2324 being exploited?
There is no known exploitation of CVE-2014-2324 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2022-29303 SolarView Compact Command Injection
- CVE-2022-31374 File upload in n/a
- CVE-2021-20658 SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors.
- CVE-2023-27514 Command injection in SolarView Compact
- CVE-2023-27518 Memory corruption in SolarView Compact
Sources
Also known as DEBIAN-CVE-2014-2324, GHSA-mvq4-g5jc-x2wr, UBUNTU-CVE-2014-2324.