CVE-2013-4547

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

• CWE-116

• http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigation, Vendor Advisory
• http://secunia.com/advisories/55757Third Party Advisory
• http://secunia.com/advisories/55822Third Party Advisory
• http://secunia.com/advisories/55825Third Party Advisory
• http://www.debian.org/security/2012/dsa-2802Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00007.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00084.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00118.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00119.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.htmlMitigation, Vendor Advisory
• http://secunia.com/advisories/55757Third Party Advisory
• http://secunia.com/advisories/55822Third Party Advisory
• http://secunia.com/advisories/55825Third Party Advisory
• http://www.debian.org/security/2012/dsa-2802Broken Link

Published

Nov 23, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4541The usb_device_post_load function in hw/usb/bus.c in QEMU be…
• CVE-2013-4542The virtio_scsi_load_request function in hw/scsi/scsi-bus.c …
• CVE-2013-4543Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4544hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allow…
• CVE-2013-4545cURL and libcurl 7.18.0 through 7.32.0, when built with Open…
• CVE-2013-4546The repository import feature in gitlab-shell before 1.7.4, …
• CVE-2013-4548The mm_newkeys_from_blob function in monitor_wrap.c in sshd …
• CVE-2013-4549QXmlSimpleReader in Qt before 5.2 allows context-dependent a…
• CVE-2013-4550Bip before 0.8.9, when running as a daemon, writes SSL hands…
• CVE-2013-4551Xen 4.2.x and 4.3.x, when nested virtualization is disabled,…
• CVE-2013-4552lib/Auth/Source/External.php in the drupalauth module before…
• CVE-2013-4553The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3…