CVE-2009-4896 Path traversal in n/a
Authenticated users can exploit path traversal in the mlmmj web admin interface to overwrite, create, or delete arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4896?
CVE-2009-4896 is a medium-severity path traversal vulnerability in n/a, published on 2 Aug 2010. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.
Weakness: CWE-22
Which versions are affected by CVE-2009-4896?
It affects 1 product.
Products include Mlmmj Mlmmj.
How do I fix CVE-2009-4896?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2009-4896 being exploited?
There is no known exploitation of CVE-2009-4896 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2009-4896, DSA-2073-1, GHSA-qjfc-4q6g-mh2f.