Litespeed Web Server
Monthly
Internal redirection URL validation in LiteSpeed Web Server before 6.3.7 build 1 can be bypassed in a narrow 'corner case', allowing an authenticated remote user with low privileges (PR:L per the vendor vector) to have a crafted URL resolve to a resource other than the one the validation logic approved. Because the flaw stems from the URL normalization path decoding the same value more than once (CWE-174), the malformed request passes the check in its first-decoded form but takes on different meaning after a second decode; the assessed impact is high confidentiality loss with only limited integrity impact and no availability loss, with scope crossing into the underlying system. The vendor's CVSS 4.0 vector rates this 9.4 with low attack complexity and all impacts High, whereas our independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) treats exploitation as high complexity because only an undocumented, highly specific corner case triggers it; no public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV), so exposure is limited in practice to attackers who can reach the redirect path and reproduce the exact crafted input.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Internal redirection URL validation in LiteSpeed Web Server before 6.3.7 build 1 can be bypassed in a narrow 'corner case', allowing an authenticated remote user with low privileges (PR:L per the vendor vector) to have a crafted URL resolve to a resource other than the one the validation logic approved. Because the flaw stems from the URL normalization path decoding the same value more than once (CWE-174), the malformed request passes the check in its first-decoded form but takes on different meaning after a second decode; the assessed impact is high confidentiality loss with only limited integrity impact and no availability loss, with scope crossing into the underlying system. The vendor's CVSS 4.0 vector rates this 9.4 with low attack complexity and all impacts High, whereas our independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) treats exploitation as high complexity because only an undocumented, highly specific corner case triggers it; no public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV), so exposure is limited in practice to attackers who can reach the redirect path and reproduce the exact crafted input.
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.