CVE-2011-4963 : nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers

nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.

Published 2012-07-26 19:55:01

Updated 2025-04-11 00:51:22

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2011-4963

F5 » Nginx
Versions from including (>=) 0.7.52 and before (<) 1.2.1
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
F5 » Nginx » Version: 1.3.0
cpe:2.3:a:f5:nginx:1.3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2011-4963

EPSS FAQ

0.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-4963

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

References for CVE-2011-4963

http://english.securitylab.ru/lab/PT-2012-06

PT-2012-06: Security restrictions bypass in nginx for Windows
Mitigation;Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.html

[nginx-announce] security advisory
Mitigation;Vendor Advisory
http://nginx.org/en/security_advisories.html

nginx security advisories
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2011-4963

Products affected by CVE-2011-4963

Exploit prediction scoring system (EPSS) score for CVE-2011-4963

CVSS scores for CVE-2011-4963

References for CVE-2011-4963