Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2003-1137: sh-httpd permits remote file read or script execution

CVE-2003-1137 · published 23 years ago

Summary

The sh-httpd web server (versions 0.3 and 0.4) can be tricked into revealing files or running unwanted scripts when a request includes a * character. This could let an outsider view sensitive data or run code on your server. Update to a newer version or apply the vendor's patch to block the wildcard request.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
charles_steinkuehler	sh-httpd	0.3 0.4 `cpe:2.3:a:charles_steinkuehler:sh-httpd:0.3:::::::*`

Original advisory text

Charles Steinkuehler sh-httpd 0.3 and 0.4 allows remote attackers to read files or execute arbitrary CGI scripts via a GET request that contains an asterisk (*) wildcard character.

References

http://www.securityfocus.com/archive/1/342473 Exploit Patch Vendor Advisory
http://www.securityfocus.com/archive/1/342766 Patch
http://www.securityfocus.com/bid/8897 Exploit Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13519

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

7% chance of attack within 30 days

Timeline

Published27 Oct 2003

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2003-1137 · NVD

Track software like this

Free during beta