What is wrong
An issue exists in nginx where URI processing handles unescaped space characters improperly. Remote attackers can exploit this flaw to bypass intended access restrictions.
Who is affected
This affects nginx versions 0.8.41 through 1.4.3, and versions 1.5.x before 1.5.7.
What to do
Upgrade affected nginx installations to version 1.4.4 or 1.5.7.
Original description
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
Affected software
- nginx ≥ 1.5.0 ≤ 1.5.6≥ 0.8.41 < 1.4.4 Fixed in: 1.4.4 exact match
Details
- Published
- 2013-11-24
- Last modified
- 2024-08-07
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- EPSS (30-day exploit probability)
- 68.46% (percentile 99)
References
- cve.org/CVE-2013-4547
- nvd.nist.gov/vuln/detail/CVE-2013-4547
- secunia.com/advisories/55757
- lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.html
- lists.opensuse.org/opensuse-updates/2013-11/msg00084.html
- secunia.com/advisories/55825
- secunia.com/advisories/55822
- lists.opensuse.org/opensuse-updates/2013-11/msg00119.html
- lists.opensuse.org/opensuse-updates/2013-11/msg00118.html
- www.debian.org/security/2012/dsa-2802
- mailman.nginx.org/pipermail/nginx-announce/2013/000125.html
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.