Unscored severity · published Jun 15, 2010
CVE-2010-2263
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document…
–
CVSS
71.9%
EPSS
No
On KEV
Description
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)71.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
Nginx · F5
0.7.52 before 0.7.66; 0.8.0 through 0.8.39 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2263
Exploit
http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html
Exploit
http://www.exploit-db.com/exploits/13818
Exploit
http://www.exploit-db.com/exploits/13822
Exploit
http://www.securityfocus.com/bid/40760
More from Nginx
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-20005
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false…
9.8
CVE-2016-0746
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or…
9.8
CVE-2009-3555
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and…
7.8
CVE-2022-41741
NGINX ngx_http_mp4_module vulnerability CVE-2022-41741