CVE-2010-2263 nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::...
MediumCVSS 5.0
EPSS 71.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 nginx | >= 0.7.52, < 0.7.66 | 0.7.66 |
| f5 nginx | >= 0.8.0, <= 0.8.39 | No fix listed |
References
- Debian Security Tracker CVE-2010-2263 vendor-advisory
- spa-s3c.blogspot.com exploit release-notes third-party-advisory
- 13818 exploit third-party-advisory vdb-entry
- 13822 exploit third-party-advisory vdb-entry
- 40760 exploit third-party-advisory vdb-entry