VDB
CVE-2007-4727
CVE-2007-4727
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
EPSS 12.89% · 96.3th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
12.89%
96.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| lighttpd | lighttpd | 0 |
Timeline
- Sep 12, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Nov 1, 2023 EPSS Score
- Dec 24, 2023 EPSS Score
- Feb 15, 2024 EPSS Score
References
- https://issues.rpath.com/browse/RPL-1715 url
- 20070917 FLEA-2007-0054-1 lighttpd mailing-list
- 26732 third-party-advisory
- http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt url
- lighttpd-modfastcgi-code-execution(36526) vdb
- 26997 third-party-advisory
- 26794 third-party-advisory
- SUSE-SR:2007:020 vendor-advisory
- FEDORA-2007-2132 vendor-advisory
- GLSA-200709-16 vendor-advisory
- http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ url
- 25622 vdb
- https://bugzilla.redhat.com/show_bug.cgi?id=284511 url
- 3127 third-party-advisory
- http://trac.lighttpd.net/trac/changeset/1986 url
- 26824 third-party-advisory
- ADV-2007-3110 vdb
- 27229 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2007-4727 advisory
- http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability url