CVE-2015-3200

HIGH 7.5CVE-2015-3200 · Published 09/06/2015 · updated 17/06/2026

In short

CVE-2015-3200 is a HIGH (CVSS 7.5) vulnerability affecting virtual customer access system (hp), lighttpd (lighttpd).
Chance of exploitation in the next 30 days (EPSS): 9.9%, higher than 95.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
virtual customer access system hp	`≤ 15.07`	No fix yet
lighttpd lighttpd	`≤ 1.4.35`	No fix yet

Description

mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.

References

jaanuskp.blogspot.com/2015/05/cve-2015-3200.html · Exploit
lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.html
lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.html
redmine.lighttpd.net/issues/2646 · Vendor Advisory
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · Third Party Advisory
securityfocus.com/bid/74813
securitytracker.com/id/1032405 · VDB Entry
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay · Vendor Advisory
kc.mcafee.com/corporate/index

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free