IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
5.8Media

CVE-2022-0072Directory Traversal in OpenLiteSpeed Web Server

LiteSpeed Technologies OpenLiteSpeed Web Server; LiteSpeed Technologies LiteSpeed Web Server Publicada: (hace 4 años)

Descripción

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

Debilidad (CWE): CWE-22

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
LiteSpeed Technologies LiteSpeed Web Server 1.5.11 – ≤ 1.5.12, 1.6.5 – ≤ 1.6.20.1, 1.7.0 – < 1.7.16.1
LiteSpeed Technologies OpenLiteSpeed Web Server 1.5.11 – ≤ 1.5.12, 1.6.5 – ≤ 1.6.20.1, 1.7.0 – < 1.7.16.1

Referencias y parches

CVE recientes del mismo producto — LiteSpeed / OpenLiteSpeed

9.4Crítica
CVE-2026-93903
litespeedtech LiteSpeed Web Server

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

7.2Alta
CVE-2026-31386
LiteSpeed Technologies OpenLiteSpeed; LiteSpeed Technologies LSWS Enterprise

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

1.4%EPSS
8.8Alta
CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Technologies Inc LiteSpeed Web Server Enterprise

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, a…

1.6%EPSS
7.2Alta
CVE-2021-47855

Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

LiteSpeed Technologies OpenLiteSpeed

Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execut…