CVE-2014-2324
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in...
CVE-2014-2324 is a medium vulnerability (CVSS 5.0) in Lighttpd, published March 12, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.5%, the 98th percentile. Fixed in lighttpd 1.4.33-1+nmu3.
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
CVE-2014-2324- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
CVE-2014-2324- Updated
- 2026-11-02
EUVDEUVD-2014-2361 No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
EUVD-2014-2361- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mvq4-g5jc-x2wr No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in...
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
GHSA-mvq4-g5jc-x2wr- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
CVE-2014-2324- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2324 No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
DEBIAN-CVE-2014-2324- Updated
- 2026-11-02
OSVMGASA-2014-0133 No score
Updated lighttpd package fixes security vulnerabilities
SQL injection vulnerability in lighttpd before 1.4.35 when mod_mysql_vhost is in use, due to insufficient validation of hostnames in HTTP requests (CVE-2014-2323).
Possible path traversal vulnerabilities in lighttpd before 1.4.35 when either mod_evhost or mod_simple_vhost are in use, due to insufficient validation of hostnames in HTTP requests (CVE-2014-2324).
- Record
MGASA-2014-0133- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10402-1 No score
lighttpd-1.4.37-1.6 on GA media
These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10402-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-2324 No score
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
- Record
UBUNTU-CVE-2014-2324- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 |
before 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
lighttpdDebian:13 |
before 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
lighttpdDebian:14 |
before 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
lighttpdDebian:6.0 |
before 1.4.28-2+squeeze1.6, plus listed versions 1.4.28-21.4.28-2+squeeze11.4.28-2+squeeze1.11.4.28-2+squeeze1.21.4.28-2+squeeze1.31.4.28-2+squeeze1.41.4.28-2+squeeze1.5 |
1.4.28-2+squeeze1.6 |
lighttpdDebian:7 |
before 1.4.31-4+deb7u3, plus listed versions 1.4.31-41.4.31-4+deb7u11.4.31-4+deb7u2 |
1.4.31-4+deb7u3 |
lighttpdMageia:3 |
before 1.4.32-3.7.mga3 | 1.4.32-3.7.mga3 |
lighttpdMageia:4 |
before 1.4.33-4.1.mga4 | 1.4.33-4.1.mga4 |
lighttpdUbuntu:14.04:LTS |
before 1.4.33-1+nmu2ubuntu2.1, plus listed versions 1.4.31-3ubuntu31.4.33-1ubuntu11.4.33-1+nmu2ubuntu11.4.33-1+nmu2ubuntu2 |
1.4.33-1+nmu2ubuntu2.1 |
lighttpdopenSUSE:Tumbleweed |
before 1.4.37-1.6 | 1.4.37-1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sp4c30x1/uc_httpd_exploit | 2017-12-30 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
lighttpd.net/2014/3/12/1.4.35
securityfocus.com/bid/66157
download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt
debian.org/security/2014/dsa-2877
lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html
secunia.com/advisories/57514
Show 23 moreShow less
marc.info?l=bugtraq&m=141576815022399&w=2
seclists.org/oss-sec/2014/q1/564
jvn.jp/en/jp/JVN37417423/index.html
nvd.nist.gov/vuln/detail/CVE-2014-2324
github.com/advisories/GHSA-mvq4-g5jc-x2wr
security-tracker.debian.org/tracker/CVE-2014-2324
advisories.mageia.org/MGASA-2014-0133.html
bugs.mageia.org/show_bug.cgi?id=13003
openwall.com/lists/oss-security/2014/03/12/12
ubuntu.com/security/CVE-2014-2324
cve.org/CVERecord?id=CVE-2014-2324
suse.com/security/cve/CVE-2010-0295