Vulnerability Description
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
CVSS Score
7.5
HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | Nginx | >= 0.8.41, < 1.4.4 |
| Suse | Lifecycle Management Server | 1.3 |
| Suse | Studio Onsite | 1.3 |
| Suse | Webyast | 1.3 |
| Opensuse | Opensuse | 11.4 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing ListThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigationVendor Advisory
- http://secunia.com/advisories/55757Third Party Advisory
- http://secunia.com/advisories/55822Third Party Advisory
- http://secunia.com/advisories/55825Third Party Advisory
- http://www.debian.org/security/2012/dsa-2802Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing ListThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigationVendor Advisory
- http://secunia.com/advisories/55757Third Party Advisory
FAQ
What is CVE-2013-4547?
CVE-2013-4547 is a vulnerability with a CVSS score of 7.5 (HIGH). nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
How severe is CVE-2013-4547?
CVE-2013-4547 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4547?
Check the references section above for vendor advisories and patch information. Affected products include: F5 Nginx, Suse Lifecycle Management Server, Suse Studio Onsite, Suse Webyast, Opensuse Opensuse.