Evil-DB LogoEvil-DB
← All CVEs

CVE-2006-0814

medium · 5

response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.

5
CVSS
10.6%
EPSS (exploit prob.)
96th
EPSS percentile
2006-03-06
Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

VendorProductAffected versions
lighttpdlighttpd1.0.2
lighttpdlighttpd1.0.3
lighttpdlighttpd1.1.0
lighttpdlighttpd1.1.1
lighttpdlighttpd1.1.2
lighttpdlighttpd1.1.3
lighttpdlighttpd1.1.4
lighttpdlighttpd1.1.5
lighttpdlighttpd1.1.6
lighttpdlighttpd1.1.7
lighttpdlighttpd1.1.8
lighttpdlighttpd1.1.9
lighttpdlighttpd1.2.0
lighttpdlighttpd1.2.1
lighttpdlighttpd1.2.2
lighttpdlighttpd1.2.3
lighttpdlighttpd1.2.4
lighttpdlighttpd1.2.5
lighttpdlighttpd1.2.6
lighttpdlighttpd1.2.7
lighttpdlighttpd1.2.8
lighttpdlighttpd1.3.0
lighttpdlighttpd1.3.1
lighttpdlighttpd1.3.2
lighttpdlighttpd1.3.3
lighttpdlighttpd1.3.4
lighttpdlighttpd1.3.5
lighttpdlighttpd1.3.6
lighttpdlighttpd1.3.7
lighttpdlighttpd1.3.8
lighttpdlighttpd1.3.9
lighttpdlighttpd1.3.10
lighttpdlighttpd1.3.11
lighttpdlighttpd1.3.12
lighttpdlighttpd1.3.13
lighttpdlighttpd1.3.14
lighttpdlighttpd1.3.15
lighttpdlighttpd1.3.16
lighttpdlighttpd1.4.0
lighttpdlighttpd1.4.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2006-0814