CVE-2013-4508

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.

• CWE-326

• http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txtExploit, Mitigation, Vendor Advisory
• http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=141576815022399&w=2Issue Tracking, Third Party Advisory
• http://openwall.com/lists/oss-security/2013/11/04/19Mailing List, Third Party Advisory
• http://redmine.lighttpd.net/issues/2525Issue Tracking, Vendor Advisory
• http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/Broken Link
• https://www.debian.org/security/2013/dsa-2795Third Party Advisory
• http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txtExploit, Mitigation, Vendor Advisory
• http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=141576815022399&w=2Issue Tracking, Third Party Advisory
• http://openwall.com/lists/oss-security/2013/11/04/19Mailing List, Third Party Advisory
• http://redmine.lighttpd.net/issues/2525Issue Tracking, Vendor Advisory
• http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/Broken Link
• https://www.debian.org/security/2013/dsa-2795Third Party Advisory

Published

Nov 8, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4502The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-…
• CVE-2013-4503Cross-site scripting (XSS) vulnerability in the Feed Element…
• CVE-2013-4504The Monster Menus module 7.x-1.x before 7.x-1.15 allows remo…
• CVE-2013-4505The is_this_legal function in mod_dontdothat for Apache Subv…
• CVE-2013-4506Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4507Cross-site scripting (XSS) vulnerability in CollectiveAccess…
• CVE-2013-4509The default configuration of IBUS 1.5.4, and possibly 1.5.2 …
• CVE-2013-4510Directory traversal vulnerability in the client in Tryton 3.…
• CVE-2013-4511Multiple integer overflows in Alchemy LCD frame-buffer drive…
• CVE-2013-4512Buffer overflow in the exitcode_proc_write function in arch/…
• CVE-2013-4513Buffer overflow in the oz_cdev_write function in drivers/sta…
• CVE-2013-4514Multiple buffer overflows in drivers/staging/wlags49_h2/wl_p…