CVE-2019-16278 — Nostromo nhttpd Directory Traversal Vulnerability

provenance: imported · CVE: CVE-2019-16278

CVE-2019-16278: Nostromo nhttpd Directory Traversal Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Nostromo
Product	nhttpd
Date added	2024-11-07
Due date	2024-11-28
Ransomware campaign use	Unknown

Description

Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.nazgul.ch/dev/nostromo_cl.txt ; https://nvd.nist.gov/vuln/detail/CVE-2019-16278

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-16278
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog