VulnerabilityModified
CVE-2010-2263
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
MEDIUM 5.0EPSS 71.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 71.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 71.93% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- f5/nginx
- Source
- cve@mitre.org
References
- http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.htmlExploit, Release Notes, Third Party Advisory
- http://www.exploit-db.com/exploits/13818Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/13822Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/40760Exploit, Third Party Advisory, VDB Entry
- http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.htmlExploit, Release Notes, Third Party Advisory
- http://www.exploit-db.com/exploits/13818Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/13822Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/40760Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.