Lucene search
HistoryNov 24, 2009 - 5:30 p.m.
CVE-2009-3898
CVSS2
4.9
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.004
Percentile
75.1%
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a … (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
Affected configurations
Node
f5nginxRange≤0.7.62
ORf5nginxMatch0.1.0
ORf5nginxMatch0.1.1
ORf5nginxMatch0.1.2
ORf5nginxMatch0.1.3
ORf5nginxMatch0.1.4
ORf5nginxMatch0.1.5
ORf5nginxMatch0.1.6
ORf5nginxMatch0.1.7
ORf5nginxMatch0.1.8
ORf5nginxMatch0.1.9
ORf5nginxMatch0.1.10
ORf5nginxMatch0.1.11
ORf5nginxMatch0.1.12
ORf5nginxMatch0.1.13
ORf5nginxMatch0.1.14
ORf5nginxMatch0.1.15
ORf5nginxMatch0.1.16
ORf5nginxMatch0.1.17
ORf5nginxMatch0.1.18
ORf5nginxMatch0.1.19
ORf5nginxMatch0.1.20
ORf5nginxMatch0.1.21
ORf5nginxMatch0.1.22
ORf5nginxMatch0.1.23
ORf5nginxMatch0.1.24
ORf5nginxMatch0.1.25
ORf5nginxMatch0.1.26
ORf5nginxMatch0.1.27
ORf5nginxMatch0.1.28
ORf5nginxMatch0.1.29
ORf5nginxMatch0.1.30
ORf5nginxMatch0.1.31
ORf5nginxMatch0.1.32
ORf5nginxMatch0.1.33
ORf5nginxMatch0.1.34
ORf5nginxMatch0.1.35
ORf5nginxMatch0.1.36
ORf5nginxMatch0.1.37
ORf5nginxMatch0.1.38
ORf5nginxMatch0.1.39
ORf5nginxMatch0.1.40
ORf5nginxMatch0.1.41
ORf5nginxMatch0.1.42
ORf5nginxMatch0.1.43
ORf5nginxMatch0.1.44
ORf5nginxMatch0.1.45
ORf5nginxMatch0.2.0
ORf5nginxMatch0.2.1
ORf5nginxMatch0.2.2
ORf5nginxMatch0.2.3
ORf5nginxMatch0.2.4
ORf5nginxMatch0.2.5
ORf5nginxMatch0.2.6
ORf5nginxMatch0.3.0
ORf5nginxMatch0.3.1
ORf5nginxMatch0.3.2
ORf5nginxMatch0.3.3
ORf5nginxMatch0.3.4
ORf5nginxMatch0.3.5
ORf5nginxMatch0.3.6
ORf5nginxMatch0.3.7
ORf5nginxMatch0.3.8
ORf5nginxMatch0.3.9
ORf5nginxMatch0.3.10
ORf5nginxMatch0.3.11
ORf5nginxMatch0.3.12
ORf5nginxMatch0.3.13
ORf5nginxMatch0.3.14
ORf5nginxMatch0.3.15
ORf5nginxMatch0.3.16
ORf5nginxMatch0.3.17
ORf5nginxMatch0.3.18
ORf5nginxMatch0.3.19
ORf5nginxMatch0.3.20
ORf5nginxMatch0.3.21
ORf5nginxMatch0.3.22
ORf5nginxMatch0.3.23
ORf5nginxMatch0.3.24
ORf5nginxMatch0.3.25
ORf5nginxMatch0.3.26
ORf5nginxMatch0.3.27
ORf5nginxMatch0.3.28
ORf5nginxMatch0.3.29
ORf5nginxMatch0.3.30
ORf5nginxMatch0.3.31
ORf5nginxMatch0.3.32
ORf5nginxMatch0.3.33
ORf5nginxMatch0.3.34
ORf5nginxMatch0.3.35
ORf5nginxMatch0.3.36
ORf5nginxMatch0.3.37
ORf5nginxMatch0.3.38
ORf5nginxMatch0.3.39
ORf5nginxMatch0.3.40
ORf5nginxMatch0.3.41
ORf5nginxMatch0.3.42
ORf5nginxMatch0.3.43
ORf5nginxMatch0.3.44
ORf5nginxMatch0.3.45
ORf5nginxMatch0.3.46
ORf5nginxMatch0.3.47
ORf5nginxMatch0.3.48
ORf5nginxMatch0.3.49
ORf5nginxMatch0.3.50
ORf5nginxMatch0.3.51
ORf5nginxMatch0.3.52
ORf5nginxMatch0.3.53
ORf5nginxMatch0.3.54
ORf5nginxMatch0.3.55
ORf5nginxMatch0.3.56
ORf5nginxMatch0.3.57
ORf5nginxMatch0.3.58
ORf5nginxMatch0.3.59
ORf5nginxMatch0.3.60
ORf5nginxMatch0.3.61
ORf5nginxMatch0.4.0
ORf5nginxMatch0.4.1
ORf5nginxMatch0.4.2
ORf5nginxMatch0.4.3
ORf5nginxMatch0.4.4
ORf5nginxMatch0.4.5
ORf5nginxMatch0.4.6
ORf5nginxMatch0.4.7
ORf5nginxMatch0.4.8
ORf5nginxMatch0.4.9
ORf5nginxMatch0.4.10
ORf5nginxMatch0.4.11
ORf5nginxMatch0.4.12
ORf5nginxMatch0.4.13
ORf5nginxMatch0.5.0
ORf5nginxMatch0.5.1
ORf5nginxMatch0.5.2
ORf5nginxMatch0.5.3
ORf5nginxMatch0.5.4
ORf5nginxMatch0.5.5
ORf5nginxMatch0.5.6
ORf5nginxMatch0.5.7
ORf5nginxMatch0.5.8
ORf5nginxMatch0.5.9
ORf5nginxMatch0.5.10
ORf5nginxMatch0.5.11
ORf5nginxMatch0.5.12
ORf5nginxMatch0.5.13
ORf5nginxMatch0.5.14
ORf5nginxMatch0.5.15
ORf5nginxMatch0.5.16
ORf5nginxMatch0.5.17
ORf5nginxMatch0.5.18
ORf5nginxMatch0.5.19
ORf5nginxMatch0.5.20
ORf5nginxMatch0.5.21
ORf5nginxMatch0.5.22
ORf5nginxMatch0.5.23
ORf5nginxMatch0.5.24
ORf5nginxMatch0.5.25
ORf5nginxMatch0.5.26
ORf5nginxMatch0.5.27
ORf5nginxMatch0.5.28
ORf5nginxMatch0.5.29
ORf5nginxMatch0.5.30
ORf5nginxMatch0.5.31
ORf5nginxMatch0.5.32
ORf5nginxMatch0.5.33
ORf5nginxMatch0.5.34
ORf5nginxMatch0.5.35
ORf5nginxMatch0.5.36
ORf5nginxMatch0.5.37
ORf5nginxMatch0.6.0
ORf5nginxMatch0.6.1
ORf5nginxMatch0.6.2
ORf5nginxMatch0.6.3
ORf5nginxMatch0.6.4
ORf5nginxMatch0.6.5
ORf5nginxMatch0.6.6
ORf5nginxMatch0.6.7
ORf5nginxMatch0.6.8
ORf5nginxMatch0.6.9
ORf5nginxMatch0.6.10
ORf5nginxMatch0.6.11
ORf5nginxMatch0.6.12
ORf5nginxMatch0.6.13
ORf5nginxMatch0.6.14
ORf5nginxMatch0.6.15
ORf5nginxMatch0.6.17
ORf5nginxMatch0.6.18
ORf5nginxMatch0.6.19
ORf5nginxMatch0.6.20
ORf5nginxMatch0.6.21
ORf5nginxMatch0.6.22
ORf5nginxMatch0.6.23
ORf5nginxMatch0.6.24
ORf5nginxMatch0.6.25
ORf5nginxMatch0.6.26
ORf5nginxMatch0.6.27
ORf5nginxMatch0.6.28
ORf5nginxMatch0.6.29
ORf5nginxMatch0.6.30
ORf5nginxMatch0.6.31
ORf5nginxMatch0.6.32
ORf5nginxMatch0.6.33
ORf5nginxMatch0.6.34
ORf5nginxMatch0.6.35
ORf5nginxMatch0.6.36
ORf5nginxMatch0.6.37
ORf5nginxMatch0.6.38
ORf5nginxMatch0.7.0
ORf5nginxMatch0.7.1
ORf5nginxMatch0.7.2
ORf5nginxMatch0.7.3
ORf5nginxMatch0.7.4
ORf5nginxMatch0.7.5
ORf5nginxMatch0.7.6
ORf5nginxMatch0.7.7
ORf5nginxMatch0.7.8
ORf5nginxMatch0.7.9
ORf5nginxMatch0.7.10
ORf5nginxMatch0.7.11
ORf5nginxMatch0.7.12
ORf5nginxMatch0.7.13
ORf5nginxMatch0.7.14
ORf5nginxMatch0.7.15
ORf5nginxMatch0.7.16
ORf5nginxMatch0.7.17
ORf5nginxMatch0.7.18
ORf5nginxMatch0.7.19
ORf5nginxMatch0.7.20
ORf5nginxMatch0.7.21
ORf5nginxMatch0.7.22
ORf5nginxMatch0.7.23
ORf5nginxMatch0.7.24
ORf5nginxMatch0.7.25
ORf5nginxMatch0.7.26
ORf5nginxMatch0.7.27
ORf5nginxMatch0.7.28
ORf5nginxMatch0.7.29
ORf5nginxMatch0.7.30
ORf5nginxMatch0.7.31
ORf5nginxMatch0.7.32
ORf5nginxMatch0.7.33
ORf5nginxMatch0.7.34
ORf5nginxMatch0.7.35
ORf5nginxMatch0.7.36
ORf5nginxMatch0.7.37
ORf5nginxMatch0.7.38
ORf5nginxMatch0.7.39
ORf5nginxMatch0.7.40
ORf5nginxMatch0.7.41
ORf5nginxMatch0.7.42
ORf5nginxMatch0.7.43
ORf5nginxMatch0.7.44
ORf5nginxMatch0.7.45
ORf5nginxMatch0.7.46
ORf5nginxMatch0.7.47
ORf5nginxMatch0.7.48
ORf5nginxMatch0.7.49
ORf5nginxMatch0.7.50
ORf5nginxMatch0.7.51
ORf5nginxMatch0.7.52
ORf5nginxMatch0.7.53
ORf5nginxMatch0.7.54
ORf5nginxMatch0.7.55
ORf5nginxMatch0.7.56
ORf5nginxMatch0.7.57
ORf5nginxMatch0.7.58
ORf5nginxMatch0.7.59
ORf5nginxMatch0.7.60
ORf5nginxMatch0.7.61
ORf5nginxMatch0.8.0
ORf5nginxMatch0.8.1
ORf5nginxMatch0.8.2
ORf5nginxMatch0.8.3
ORf5nginxMatch0.8.4
ORf5nginxMatch0.8.5
ORf5nginxMatch0.8.6
ORf5nginxMatch0.8.7
ORf5nginxMatch0.8.8
ORf5nginxMatch0.8.9
ORf5nginxMatch0.8.10
ORf5nginxMatch0.8.11
ORf5nginxMatch0.8.12
ORf5nginxMatch0.8.13
ORf5nginxMatch0.8.14
ORf5nginxMatch0.8.15
ORnginxnginxMatch0.6.1516
References
archives.neohapsis.com/archives/fulldisclosure/2009-09/0379.html
marc.info/?l=oss-security&m=125897327321676&w=2
marc.info/?l=oss-security&m=125897425223039&w=2
marc.info/?l=oss-security&m=125900327409842&w=2
secunia.com/advisories/36818
secunia.com/advisories/48577
security.gentoo.org/glsa/glsa-201203-22.xml
www.openwall.com/lists/oss-security/2009/11/20/1
www.openwall.com/lists/oss-security/2009/11/23/10
Related
ubuntucve
ubuntucve
CVE-2009-3898
2009-11-24 00:00:00
cve
cve
CVE-2009-3898
2009-11-24 17:30:00
cvelist
cvelist
CVE-2009-3898
2009-11-24 17:00:00
debiancve
debiancve
CVE-2009-3898
2009-11-24 17:30:00
prion
prion
Directory traversal
2009-11-24 17:30:00
nginx
nginx
Directory traversal vulnerability
2009-11-24 17:30:00
nessus
nessus
nginx < 0.7.63 / 0.8.x < 0.8.17 Directory Traversal
2018-03-09 00:00:00
GLSA-201203-22 : nginx: Multiple vulnerabilities
2012-06-21 00:00:00
openvas
openvas
nginx WebDAV Multiple Directory Traversal Vulnerabilities
2009-10-01 00:00:00
nginx WebDAV Multiple Directory Traversal Vulnerabilities
2009-10-01 00:00:00
Gentoo Security Advisory GLSA 201203-22 (nginx)
2012-04-30 00:00:00
gentoo
gentoo
nginx: Multiple vulnerabilities
2012-03-28 00:00:00
CVSS2
4.9
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.004
Percentile
75.1%
Related for NVD:CVE-2009-3898