CVE-2019-16278

Nostromo nhttpd Directory Traversal Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99.0%

What it is

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

CISA: Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: November 28, 2024

Added to the CISA list: November 7, 2024
Published: October 14, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.0% in the top 0.1% of all known vulnerabilities
Weakness: CWE-22
More details: NVD · CVE.org · CISA

All references (5)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.