Описание
LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."
Ссылки
Уязвимые конфигурации
Конфигурация 1Версия до 3.2.3 (включая)
cpe:2.3:a:litespeed_technologies:litespeed_web_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 98%
0.59125
Средний
5 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
github
почти 4 года назад
LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."
EPSS
Процентиль: 98%
0.59125
Средний
5 Medium
CVSS2
Дефекты
CWE-200