Threats tagged 'ghsa-mrxw-pq69-7j5x'

A vulnerability in BusyBox's HTTP daemon (httpd) with pre-compressed file support enabled allows authentication checks to be bypassed. The flaw occurs because authentication is checked against the requested URL path rather than the actual pre-compressed file served. An attacker can exploit this by requesting an uncompressed file path with gzip encoding, bypassing password protections configured for the compressed file. This can lead to unauthorized disclosure of sensitive files. The issue is considered moderate due to its niche configuration requirements and limited exposure in typical Red Hat enterprise environments.