CVE-2009-4648 Privilege escalation in n/a
Local administrators can escalate privileges via sudo misconfigurations in Accellion Secure File Transfer Appliance.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-4648?
CVE-2009-4648 is a high-severity vulnerability in n/a, published on 19 Feb 2010. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command.
Weakness: CWE-264
Which versions are affected by CVE-2009-4648?
It affects 1 product.
Products include Accellion Secure File Transfer Appliance.
How do I fix CVE-2009-4648?
No fix has been published for CVE-2009-4648 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-4648 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-4648 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4fqj-948j-w2qf.