Unscored severity · published Jan 27, 2009
CVE-2009-0288
Directory traversal vulnerability in k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to read arbitrary files outside the TFTP root directory via directory…
–
CVSS
2.7%
EPSS
No
On KEV
Description
Directory traversal vulnerability in k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to read arbitrary files outside the TFTP root directory via directory traversal sequences in a GET request.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tftputil · Windows Tftp Utility
1.2.0; 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0288
Vendor Advisory
http://secunia.com/advisories/33561
Patch
http://sourceforge.net/forum/forum.php?forum_id=894598
URL Repurposed
http://www.princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-directory-traversal
www.securityfocus.com
http://www.securityfocus.com/archive/1/500106/100/0/threaded
Patch
http://www.securityfocus.com/bid/33287
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/48019
More from Tftputil
–
CVE-2009-0289
k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to cause a denial of service (service crash) via a long filename in a crafted request