CVE-2010-2263

nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

71.93% chance of exploitation in the next 30 days, 99th percentile

Published

2010-06-14

Updated

2024-08-07

Proof-of-concept exploits (3)

• http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html
• http://www.exploit-db.com/exploits/13822
• http://www.exploit-db.com/exploits/13818

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nginx_source_discl…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/13822
• https://www.exploit-db.com/exploits/13818

References

• CVE Record
• NVD entry

Related

• CVE-2010-2260
• CVE-2010-2265
• CVE-2010-2259
• CVE-2010-2266
• CVE-2010-2257
• CVE-2010-2273