V-240252

Discussion

Allowing malicious users the capability to traverse server directory tree can create significant vulnerabilities. Such information and the contents of files listed should not be normally readable by the web users as they often contain information relevant to the configuration and security of the web service. Older version of Lighttpd, up to 1.4.34, have been found to be vulnerable to directory traversal and subsequent directory traversal exploits. See CVE-2014-2324 for details.

Check Content

At the command prompt, execute the following command:

/opt/vmware/sbin/vami-lighttpd -v

If the Lighttpd version does not have the latest version installed, this is a finding.