Is CVE-2008-4360 being actively exploited?

CVE-2008-4360 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2008-4360?

CVE-2008-4360 has a CVSS 2.0 base score of 7.5 (HIGH).

CVE-2008-4360

HIGH · CVSS 7.5EPSS 4.3%EU EUVD

mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.

Key facts

CVSS score: 7.5 (v2.0)
Severity: HIGH
CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness (CWE): CWE-200
EPSS score: 4.3% (91th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2008-4341)
Published: October 3, 2008
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2008-4341 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
lighttpd / lighttpd

References

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html(Third Party Advisory)
http://openwall.com/lists/oss-security/2008/09/30/1(Mailing List, Third Party Advisory)
http://openwall.com/lists/oss-security/2008/09/30/2(Mailing List, Third Party Advisory)
http://openwall.com/lists/oss-security/2008/09/30/3(Mailing List, Third Party Advisory)
http://secunia.com/advisories/32069(Third Party Advisory)
http://secunia.com/advisories/32132(Third Party Advisory)
http://secunia.com/advisories/32480(Third Party Advisory)
http://secunia.com/advisories/32834(Third Party Advisory)
http://secunia.com/advisories/32972(Third Party Advisory)
http://security.gentoo.org/glsa/glsa-200812-04.xml(Third Party Advisory)
http://trac.lighttpd.net/trac/changeset/2283(Broken Link, Vendor Advisory)
http://trac.lighttpd.net/trac/changeset/2308(Broken Link, Vendor Advisory)
http://trac.lighttpd.net/trac/ticket/1589(Patch, Vendor Advisory)
http://wiki.rpath.com/Advisories:rPSA-2008-0309(Third Party Advisory)
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309(Third Party Advisory)
http://www.debian.org/security/2008/dsa-1645(Third Party Advisory)
http://www.lighttpd.net/security/lighttpd-1.4.x_userdir_lowercase.patch(Patch, Vendor Advisory)
http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt(Patch, Vendor Advisory)
http://www.securityfocus.com/archive/1/497932/100/0/threaded(Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/31600(Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2008/2741(Third Party Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/45689(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain