CVE-2007-3949

Description

mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.

Affected Platforms

Weakness Type

NVD-CWE-Other

References

• http://osvdb.org/38311
• http://secunia.com/advisories/26130
• http://secunia.com/advisories/26158
• http://secunia.com/advisories/26505
• http://secunia.com/advisories/26593
• http://security.gentoo.org/glsa/glsa-200708-11.xml