Information Disclosure in Lighttpd's mod_cgi

CVE-2008-1111

What is CVE-2008-1111?

The mod_cgi module in Lighttpd version 1.4.18 is susceptible to an information disclosure vulnerability. Specifically, when a fork failure occurs during the execution of CGI scripts, the server inadvertently sends the source code of these scripts instead of returning a standard 500 error response. This behavior enables remote attackers to gain access to sensitive information that could lead to further exploitation of the affected server. It is crucial for users of Lighttpd to address this vulnerability promptly to mitigate the risks associated with unauthorized access to confidential data.

References