Unrated severityNVD Advisory· Published Oct 3, 2008· Updated Jun 16, 2026
CVE-2008-4360
CVE-2008-4360
Description
mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
22- trac.lighttpd.net/trac/ticket/1589nvdPatchVendor Advisory
- www.lighttpd.net/security/lighttpd-1.4.x_userdir_lowercase.patchnvdPatchVendor Advisory
- www.lighttpd.net/security/lighttpd_sa_2008_06.txtnvdPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlnvdThird Party Advisory
- openwall.com/lists/oss-security/2008/09/30/1nvdMailing ListThird Party Advisory
- openwall.com/lists/oss-security/2008/09/30/2nvdMailing ListThird Party Advisory
- openwall.com/lists/oss-security/2008/09/30/3nvdMailing ListThird Party Advisory
- secunia.com/advisories/32069nvdThird Party Advisory
- secunia.com/advisories/32132nvdThird Party Advisory
- secunia.com/advisories/32480nvdThird Party Advisory
- secunia.com/advisories/32834nvdThird Party Advisory
- secunia.com/advisories/32972nvdThird Party Advisory
- security.gentoo.org/glsa/glsa-200812-04.xmlnvdThird Party Advisory
- trac.lighttpd.net/trac/changeset/2283nvdBroken LinkVendor Advisory
- trac.lighttpd.net/trac/changeset/2308nvdBroken LinkVendor Advisory
- wiki.rpath.com/Advisories:rPSA-2008-0309nvdThird Party Advisory
- wiki.rpath.com/wiki/Advisories:rPSA-2008-0309nvdThird Party Advisory
- www.debian.org/security/2008/dsa-1645nvdThird Party Advisory
- www.securityfocus.com/archive/1/497932/100/0/threadednvdThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/31600nvdThird Party AdvisoryVDB Entry
- www.vupen.com/english/advisories/2008/2741nvdThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/45689nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.