Lucene search
HistoryOct 03, 2022 - 4:23 p.m.
CVE-2009-3304
gforge
symlink attack
authorized_keys
security vulnerability
nvd
cve-2009-3304
3.3 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:P/A:P
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users’ home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
Affected configurations
Node
gforgegforgeMatch4.5.14
ORgforgegforgeMatch4.7rc2
ORgforgegforgeMatch4.8.2
| CPE | Name | Operator | Version |
|---|---|---|---|
| gforge:gforge | gforge | eq | 4.5.14 |
| gforge:gforge | gforge | eq | 4.7 |
| gforge:gforge | gforge | eq | 4.8.2 |
Related
debian
debian
[SECURITY] [DSA 1945-1] New gforge packages fix denial of service
2009-12-03 12:46:30
openvas
openvas
Debian Security Advisory DSA 1945-1 (gforge)
2009-12-10 00:00:00
Debian: Security Advisory (DSA-1945-1)
2009-12-09 00:00:00
ubuntucve
ubuntucve
CVE-2009-3304
2009-12-04 00:00:00
cvelist
cvelist
CVE-2009-3304
2022-10-03 16:23:57
nessus
nessus
Debian DSA-1945-1 : gforge - symlink attack
2010-02-24 00:00:00
prion
prion
Design/Logic Flaw
2009-12-04 19:30:00
nvd
nvd
CVE-2009-3304
2009-12-04 19:30:00
3.3 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:P/A:P
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
Related for CVE-2009-3304