Unscored severity · published Sep 8, 2009
CVE-2009-3095
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related…
–
CVSS
13.5%
EPSS
No
On KEV
Description
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.0.35 before 2.0.64; 2.2.0 before 2.2.14 · source: NVD
DL
Debian Linux · Debian
4.0 · source: NVD
FE
Fedora · Fedoraproject
10; 12 · source: NVD
LE
Linux Enterprise Desktop · Suse
10; 10 · source: NVD
LE
Linux Enterprise Server · Suse
9; 10; 10; 11 · source: NVD
MO
Mac OS X · Apple
before 10.6.3 · source: NVD
OP
Opensuse · Opensuse
10.3; 11.0; 11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3095
Broken Link
http://intevydis.com/vd-list.shtml
Mailing List
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
Issue Tracking
http://marc.info/?l=bugtraq&m=126998684522511&w=2
Issue Tracking
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Not Applicable
http://marc.info/?l=bugtraq&m=130497311408250&w=2
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability