var-201006-0493
Vulnerability from variot
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. Nginx is a high-performance web server that is widely used. It is not only often used as a reverse proxy, but also very well supported for PHP. Nginx does not handle user requests correctly. A remote attacker can exploit the vulnerability to obtain script source code information and perform denial of service attacks on the application. nginx is prone to remote source-code-disclosure and denial-of-service vulnerabilities. nginx 0.8.36 for Windows is vulnerable; other versions may also be affected
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201006-0493",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nginx",
"scope": "gte",
"trust": 1.0,
"vendor": "f5",
"version": "0.7.52"
},
{
"model": "nginx",
"scope": "lt",
"trust": 1.0,
"vendor": "f5",
"version": "0.7.66"
},
{
"model": "nginx",
"scope": "gte",
"trust": 1.0,
"vendor": "f5",
"version": "0.8.0"
},
{
"model": "nginx",
"scope": "lte",
"trust": 1.0,
"vendor": "f5",
"version": "0.8.39"
},
{
"model": "nginx",
"scope": "lt",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "0.8"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "0.7.66"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "0.8.40"
},
{
"model": "nginx",
"scope": "lt",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "0.7"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "no",
"version": null
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.16"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.15"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.2"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.0"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.1"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.14"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.3"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.4"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.13"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.6,
"vendor": "nginx",
"version": "0.7.20"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.36"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.35"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.33"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.32"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.15"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.14"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.7.65"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.7.64"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.7.62"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.7.61"
},
{
"model": "sysoev nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "igor",
"version": "0.7"
},
{
"model": "sysoev nginx",
"scope": "ne",
"trust": 0.3,
"vendor": "igor",
"version": "0.8.41"
},
{
"model": "sysoev nginx",
"scope": "ne",
"trust": 0.3,
"vendor": "igor",
"version": "0.7.66"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "BID",
"id": "40760"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "0.7.66",
"versionStartIncluding": "0.7.52",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "0.8.39",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2263"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dr_IDE Jose Antonio Vazquez Gonzalez",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
],
"trust": 0.6
},
"cve": "CVE-2010-2263",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2010-2263",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-2263",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201006-224",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. Nginx is a high-performance web server that is widely used. It is not only often used as a reverse proxy, but also very well supported for PHP. Nginx does not handle user requests correctly. A remote attacker can exploit the vulnerability to obtain script source code information and perform denial of service attacks on the application. nginx is prone to remote source-code-disclosure and denial-of-service vulnerabilities. \nnginx 0.8.36 for Windows is vulnerable; other versions may also be affected",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "BID",
"id": "40760"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-2263",
"trust": 2.7
},
{
"db": "BID",
"id": "40760",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "13818",
"trust": 1.6
},
{
"db": "EXPLOIT-DB",
"id": "13822",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2010-1094",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "BID",
"id": "40760"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"id": "VAR-201006-0493",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
}
]
},
"last_update_date": "2023-12-18T12:31:33.369000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://nginx.org/"
},
{
"title": "Nginx remote source code leak and denial of service patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/454"
},
{
"title": "Vulnerabilities with Windows file default stream",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=3683"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/13818"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/13822"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/40760"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2263"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-2263"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/40760/"
},
{
"trust": 0.3,
"url": "http://nginx.org/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "BID",
"id": "40760"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"db": "BID",
"id": "40760"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-06-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"date": "2010-06-11T00:00:00",
"db": "BID",
"id": "40760"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"date": "2010-06-15T14:04:24.313000",
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"date": "2010-06-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-06-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-1094"
},
{
"date": "2015-04-13T21:02:00",
"db": "BID",
"id": "40760"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-004869"
},
{
"date": "2021-11-10T15:52:53.917000",
"db": "NVD",
"id": "CVE-2010-2263"
},
{
"date": "2023-05-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "nginx Vulnerabilities in which source code is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-004869"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201006-224"
}
],
"trust": 0.6
}
}
Loading...