What is CVE-2009-3898?

CVE-2009-3898 is a vulnerability in F5 nginx, classified under Path Traversal. Published 2009-11-24.

Is CVE-2009-3898 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in F5 nginx

CVE-2009-3898

Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.176 (96.8th percentile) — read the EPSS interpretation.

Affected products

F5 Nginx — versions 0.1.0, 0.1.1, 0.1.2
Nginx — versions 0.6.1516
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

addisonburkett/cve_

References

secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (mailing-list, Exploit, x_refsource_FULLDISC)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)

Frequently asked questions

What is CVE-2009-3898?: CVE-2009-3898 is a vulnerability in F5 nginx, classified under Path Traversal. Published 2009-11-24.
Is CVE-2009-3898 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.