Unscored CVE-1999-1456 EUVD-1999-1437GHSA-j7q2-439r-63fw

thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) …

Published Mar 9, 2002 · Updated Aug 1, 2024 · Assigned by mitre

Description

thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.

References

http://www.acme.com/software/thttpd/thttpd.html#releasenotes
thttpd-file-read(1809) vdb-entry
19980819 thttpd 2.04 released (fwd) mailing-list