CVE-2009-3898

EPSS 1.1%

發布日:2009/11/24修改日:2026/4/28

也稱為:DEBIAN-CVE-2009-3898

描述

Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.

受影響套件(1)

Debian/nginxfrom 0, < 0.7.63-1

參考連結(1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2009-3898