CVE-2008-0408 HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
MediumCVSS 6.4
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hfs http file server | <= 2.2b | No fix listed |
References
- 28631 third-party-advisory
- 3582 third-party-advisory
- www.rejetto.com exploit
- 20080123 Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability mailing-list
- 27423 vdb-entry
- www.syhunt.com
- www.syhunt.com
- hfs-unspecified-log-injection(39876) vdb-entry