CVE-2010-2333

Litespeedtech Litespeed Web Server - Information Disclosure

Title source: rule

Description

LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.

Exploits (2)

exploitdb WORKING POC VERIFIED

by kingcope · perlremotemultiple

https://www.exploit-db.com/exploits/13850

View Code ZIP pw:eip

metasploit WORKING POC

by Kingcope, xanda · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litespeed_source_disclosure.rb

View Code ZIP pw:eip

References (7)

[Exploit] http://seclists.org/fulldisclosure/2010/Jun/288

[Vendor Advisory] http://secunia.com/advisories/40128

[Exploit] http://www.exploit-db.com/exploits/13850

[Patch, Vendor Advisory] http://www.litespeedtech.com/latest/litespeed-web-server-4.0.15-released.html

[Various Sources] http://www.litespeedtech.com/support/forum/showthread.php?t=4078

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/40815

[Third Party Advisory, VDB Entry] http://osvdb.org/65476

Scores

EPSS 0.7649

EPSS Percentile 98.9%

Details

CWE

CWE-200

Status published

Products (15)

litespeedtech/litespeed_web_server 4.0

litespeedtech/litespeed_web_server 4.0.1

litespeedtech/litespeed_web_server 4.0.2

litespeedtech/litespeed_web_server 4.0.3

litespeedtech/litespeed_web_server 4.0.4

litespeedtech/litespeed_web_server 4.0.5

litespeedtech/litespeed_web_server 4.0.6

litespeedtech/litespeed_web_server 4.0.7

litespeedtech/litespeed_web_server 4.0.8

litespeedtech/litespeed_web_server 4.0.9

... and 5 more

Published Jun 18, 2010

Tracked Since Feb 18, 2026