Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2008-4359

20
FAUCET Score

CVE-2008-4359 describes a vulnerability in lighttpd versions prior to 1.4.20, where the web server incorrectly compares URIs to configured patterns before URL decoding. This flaw could allow remote attackers to bypass access restrictions, potentially leading to the disclosure of sensitive information or unauthorized data modification. With a CVSS score of 7.5, this vulnerability is considered high severity, requiring no authentication and low attack complexity to achieve partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.4.20CPE matchmatch criteria
cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*
4.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.4
CvssVersion
2.0

Exploit Intelligence

EPSS Score
4.35%
Probability of exploitation in next 30 days
EPSS Percentile
90.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0435 is in the 83rd percentile among its peer group of 51,506 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

redhatCVE-2008-4359Moderate

lighttpd: bypass of rewrite/redirect rules using encoded urls

Jul 14, 2008

References

lists.opensuse.org / opensuse-security-announce/2008-11/msg00002.html
Third Party Advisory
openwall.com / lists/oss-security/2008/09/30/1
Mailing List
openwall.com / lists/oss-security/2008/09/30/2
Mailing List
openwall.com / lists/oss-security/2008/09/30/3
Mailing List
secunia.com / advisories/32069
Third Party Advisory
secunia.com / advisories/32132
Third Party Advisory
secunia.com / advisories/32480
Third Party Advisory
secunia.com / advisories/32834
Third Party Advisory
secunia.com / advisories/32972
Third Party Advisory
security.gentoo.org / glsa/glsa-200812-04.xml
Third Party Advisory
exchange.xforce.ibmcloud.com / vulnerabilities/45690
Third Party AdvisoryVDB Entry
trac.lighttpd.net / trac/changeset/2278
Broken LinkVendor Advisory
trac.lighttpd.net / trac/changeset/2307
Broken LinkVendor Advisory
trac.lighttpd.net / trac/changeset/2309
Broken LinkVendor Advisory
trac.lighttpd.net / trac/changeset/2310
Broken LinkVendor Advisory
trac.lighttpd.net / trac/ticket/1720
Vendor Advisory
wiki.rpath.com / Advisories:rPSA-2008-0309
Third Party Advisory
wiki.rpath.com / wiki/Advisories:rPSA-2008-0309
Third Party Advisory
debian.org / security/2008/dsa-1645
Third Party Advisory
lighttpd.net / security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch
PatchVendor Advisory
lighttpd.net / security/lighttpd_sa_2008_05.txt
Vendor Advisory
securityfocus.com / archive/1/497932/100/0/threaded
Third Party AdvisoryVDB Entry
securityfocus.com / bid/31599
Third Party AdvisoryVDB Entry
vupen.com / english/advisories/2008/2741
Third Party Advisory