CVE-2009-3898

medium · 4.9

Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.

4.9

CVSS

15.9%

EPSS (exploit prob.)

97th

EPSS percentile

2009-11-24

Published

AV:N/AC:M/Au:S/C:P/I:P/A:N

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
f5	nginx	<= 0.7.62
f5	nginx	0.1.0
f5	nginx	0.1.1
f5	nginx	0.1.2
f5	nginx	0.1.3
f5	nginx	0.1.4
f5	nginx	0.1.5
f5	nginx	0.1.6
f5	nginx	0.1.7
f5	nginx	0.1.8
f5	nginx	0.1.9
f5	nginx	0.1.10
f5	nginx	0.1.11
f5	nginx	0.1.12
f5	nginx	0.1.13
f5	nginx	0.1.14
f5	nginx	0.1.15
f5	nginx	0.1.16
f5	nginx	0.1.17
f5	nginx	0.1.18
f5	nginx	0.1.19
f5	nginx	0.1.20
f5	nginx	0.1.21
f5	nginx	0.1.22
f5	nginx	0.1.23
f5	nginx	0.1.24
f5	nginx	0.1.25
f5	nginx	0.1.26
f5	nginx	0.1.27
f5	nginx	0.1.28
f5	nginx	0.1.29
f5	nginx	0.1.30
f5	nginx	0.1.31
f5	nginx	0.1.32
f5	nginx	0.1.33
f5	nginx	0.1.34
f5	nginx	0.1.35
f5	nginx	0.1.36
f5	nginx	0.1.37
f5	nginx	0.1.38

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-3898