Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-3095

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

Published

2009-09-08T18:30:00.670

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache http_server < 2.0.64 Yes
Application apache http_server < 2.2.14 Yes
Operating System fedoraproject fedora 10 Yes
Operating System fedoraproject fedora 12 Yes
Operating System debian debian_linux 4.0 Yes
Operating System opensuse opensuse 10.3 Yes
Operating System opensuse opensuse 11.0 Yes
Operating System opensuse opensuse 11.1 Yes
Operating System suse linux_enterprise_desktop 10 Yes
Operating System suse linux_enterprise_desktop 10 Yes
Operating System suse linux_enterprise_server 9 Yes
Operating System suse linux_enterprise_server 10 Yes
Operating System suse linux_enterprise_server 10 Yes
Operating System suse linux_enterprise_server 11 Yes
Operating System apple mac_os_x < 10.6.3 Yes
References