Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2009-4053 | First vendor Publication | 2009-11-23 |
Vendor | Cve | Last vendor Modification | 2024-01-26 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | |||
---|---|---|---|
Overall CVSS Score | 6.5 | ||
Base Score | 6.5 | Environmental Score | 6.5 |
impact SubScore | 3.6 | Temporal Score | 6.5 |
Exploitabality Sub Score | 2.8 | ||
Attack Vector | Network | Attack Complexity | Low |
Privileges Required | Low | User Interaction | None |
Scope | Unchanged | Confidentiality Impact | High |
Integrity Impact | None | Availability Impact | None |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:S/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to (1) create arbitrary directories via directory traversal sequences in an MKD command or (2) create files with any contents in arbitrary directories via directory traversal sequences in a file upload request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4053 |
CAPEC : Common Attack Pattern Enumeration & Classification
Id | Name |
---|---|
CAPEC-23 | File System Function Injection, Content Based |
CAPEC-64 | Using Slashes and URL Encoding Combined to Bypass Validation Logic |
CAPEC-76 | Manipulating Input to File System Calls |
CAPEC-78 | Using Escaped Slashes in Alternate Encoding |
CAPEC-79 | Using Slashes in Alternate Encoding |
CAPEC-139 | Relative Path Traversal |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2009-12-08 | Name : iWeb Server URL Directory Traversal Vulnerability File : nvt/iWeb_37228.nasl |
2009-11-30 | Name : Home FTp Server DOS And Multiple Directory Traversal Vulnerabilities File : nvt/secpod_home_ftp_server_dir_trav_n_dos_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
60450 | Home FTP Server Upload Request Traversal Arbitrary File Creation |
60449 | Home FTP Server MKD Command Traversal Arbitrary Directory Creation |
Sources (Detail)
Source | Url |
---|---|
MISC | https://exchange.xforce.ibmcloud.com/vulnerabilities/54303 |
SECUNIA | http://secunia.com/advisories/37381 |
Alert History
Date | Informations |
---|---|
2024-01-26 21:28:11 |
|
2019-05-10 12:03:03 |
|
2016-04-26 19:16:26 |
|
2013-05-11 00:01:36 |
|