CVE-2024-3708
Assigner: AMI
Published: 2024-05-23T00:11:32.655Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: lighttpd
repo: https://github.com/lighttpd
vendor: lighttpd
versions: lessThan: 1.4.51
status: affected
version: 0
versionType: semver
credits: type: finder
value: Peles of VDOO/Jfrog, Alex Matrosov of Binarly
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(254, 254, 254);">A condition exists in lighttpd version prior to 1.4.51 whereby a remote attacker can craft an http request which could result in multiple outcomes:<br>1.) cause lighttpd to access freed memory in which case the process lighttpd is running in could be terminated or other non-deterministic behavior could result<br></span>2.) a memory information disclosure event could result which could be used to determine the state of memory which could then be used to theoretically bypass ALSR protections<br><br>This CVE will be updated with more details on July 9th, 2024 after affected parties have had time to remediate.
value: A condition exists in lighttpd version prior to 1.4.51 whereby a remote attacker can craft an http request which could result in multiple outcomes:
1.) cause lighttpd to access freed memory in which case the process lighttpd is running in could be terminated or other non-deterministic behavior could result
2.) a memory information disclosure event could result which could be used to determine the state of memory which could then be used to theoretically bypass ALSR protections

This CVE will be updated with more details on July 9th, 2024 after affected parties have had time to remediate.
impacts: capecId: CAPEC-131
descriptions: value: CAPEC-131 Resource Leak Exposure
metrics: cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: PRESENT
attackVector: NETWORK
baseScore: 2.3
baseSeverity: LOW
privilegesRequired: NONE
providerUrgency: NOT_DEFINED
subAvailabilityImpact: NONE
subConfidentialityImpact: NONE
subIntegrityImpact: NONE
userInteraction: PASSIVE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
version: 4.0
vulnAvailabilityImpact: LOW
vulnConfidentialityImpact: LOW
vulnIntegrityImpact: NONE
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: discovery: EXTERNAL
timeline: time: 2018-08-02T00:10:00.000Z
value: Original sighting
title: maliciously crafted http request could cause lighttpd crash, information leak, or other non-deterministic behavior
x_generator: engine: Vulnogram 0.2.0