CVE-2008-0407

HTTP File Server (HFS) before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request.

Link	Resource
http://www.rejetto.com/hfs/?f=wn
http://www.syhunt.com/advisories/hfs-1-username.txt
http://www.syhunt.com/advisories/hfshack.txt	Exploit
http://secunia.com/advisories/28631	Vendor Advisory
http://securityreason.com/securityalert/3582
http://www.securityfocus.com/bid/27423
https://exchange.xforce.ibmcloud.com/vulnerabilities/39877
http://www.securityfocus.com/archive/1/486874/100/0/threaded

Configuration 1

cpe:2.3:a:hfs:http_file_server:*:*:*:*:*:*:*:*

---

Published : 2008-01-29 12:00

Updated : 2018-10-15 09:59

---

NVD link : CVE-2008-0407

Mitre link : CVE-2008-0407

No products.

CWE-287