Summary
generated automatically from NVD datanginx on Windows has an access control bypass in the 1.2.x branch before 1.2.1 and the 1.3.x branch before 1.3.1. A remote attacker can request restricted files by adding a trailing dot to the path or by using certain "$index_allocation" sequences, which defeats the intended access restrictions. The flaw is rated 5.0 (MEDIUM) under CVSS v2.0 and results in limited confidentiality impact over the network without authentication.
NVD description
nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
EPSS · FIRST.org
6.0%probability of exploitation in the next 30 days
Higher than 93% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-01, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 26 juil. 2012
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (6)
- http://english.securitylab.ru/lab/PT-2012-06MitigationThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.htmlMitigationVendor Advisory
- http://nginx.org/en/security_advisories.htmlVendor Advisory
- http://english.securitylab.ru/lab/PT-2012-06MitigationThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.htmlMitigationVendor Advisory
- http://nginx.org/en/security_advisories.htmlVendor Advisory
Similar CVEs
Other vulnerabilities of type
Running nginx? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.