CVE-2009-3898: Path Traversal
Published Nov 24, 2009
·Updated
Directory traversal vulnerability in src/http/modules/ngxhttpdavmodule.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
Affected Software
285 affected components
F5 Nginx<=0.7.62
F5 Nginx=0.1.0
F5 Nginx=0.1.1
F5 Nginx=0.1.2
F5 Nginx=0.1.3
F5 Nginx=0.1.4
F5 Nginx=0.1.5
F5 Nginx=0.1.6
F5 Nginx=0.1.7
F5 Nginx=0.1.8
F5 Nginx=0.1.9
F5 Nginx=0.1.10
F5 Nginx=0.1.11
F5 Nginx=0.1.12
F5 Nginx=0.1.13
F5 Nginx=0.1.14
F5 Nginx=0.1.15
F5 Nginx=0.1.16
F5 Nginx=0.1.17
F5 Nginx=0.1.18
F5 Nginx=0.1.19
F5 Nginx=0.1.20
F5 Nginx=0.1.21
F5 Nginx=0.1.22
F5 Nginx=0.1.23
F5 Nginx=0.1.24
F5 Nginx=0.1.25
F5 Nginx=0.1.26
F5 Nginx=0.1.27
F5 Nginx=0.1.28
F5 Nginx=0.1.29
F5 Nginx=0.1.30
F5 Nginx=0.1.31
F5 Nginx=0.1.32
F5 Nginx=0.1.33
F5 Nginx=0.1.34
F5 Nginx=0.1.35
F5 Nginx=0.1.36
F5 Nginx=0.1.37
F5 Nginx=0.1.38
F5 Nginx=0.1.39
F5 Nginx=0.1.40
F5 Nginx=0.1.41
F5 Nginx=0.1.42
F5 Nginx=0.1.43
F5 Nginx=0.1.44
F5 Nginx=0.1.45
F5 Nginx=0.2.0
F5 Nginx=0.2.1
F5 Nginx=0.2.2
F5 Nginx=0.2.3
F5 Nginx=0.2.4
F5 Nginx=0.2.5
F5 Nginx=0.2.6
F5 Nginx=0.3.0
F5 Nginx=0.3.1
F5 Nginx=0.3.2
F5 Nginx=0.3.3
F5 Nginx=0.3.4
F5 Nginx=0.3.5
F5 Nginx=0.3.6
F5 Nginx=0.3.7
F5 Nginx=0.3.8
F5 Nginx=0.3.9
F5 Nginx=0.3.10
F5 Nginx=0.3.11
F5 Nginx=0.3.12
F5 Nginx=0.3.13
F5 Nginx=0.3.14
F5 Nginx=0.3.15
F5 Nginx=0.3.16
F5 Nginx=0.3.17
F5 Nginx=0.3.18
F5 Nginx=0.3.19
F5 Nginx=0.3.20
F5 Nginx=0.3.21
F5 Nginx=0.3.22
F5 Nginx=0.3.23
F5 Nginx=0.3.24
F5 Nginx=0.3.25
F5 Nginx=0.3.26
F5 Nginx=0.3.27
F5 Nginx=0.3.28
F5 Nginx=0.3.29
F5 Nginx=0.3.30
F5 Nginx=0.3.31
F5 Nginx=0.3.32
F5 Nginx=0.3.33
F5 Nginx=0.3.34
F5 Nginx=0.3.35
F5 Nginx=0.3.36
F5 Nginx=0.3.37
F5 Nginx=0.3.38
F5 Nginx=0.3.39
F5 Nginx=0.3.40
F5 Nginx=0.3.41
F5 Nginx=0.3.42
F5 Nginx=0.3.43
F5 Nginx=0.3.44
F5 Nginx=0.3.45
F5 Nginx=0.3.46
F5 Nginx=0.3.47
F5 Nginx=0.3.48
F5 Nginx=0.3.49
F5 Nginx=0.3.50
F5 Nginx=0.3.51
F5 Nginx=0.3.52
F5 Nginx=0.3.53
F5 Nginx=0.3.54
F5 Nginx=0.3.55
F5 Nginx=0.3.56
F5 Nginx=0.3.57
F5 Nginx=0.3.58
F5 Nginx=0.3.59
F5 Nginx=0.3.60
F5 Nginx=0.3.61
F5 Nginx=0.4.0
F5 Nginx=0.4.1
F5 Nginx=0.4.2
F5 Nginx=0.4.3
F5 Nginx=0.4.4
F5 Nginx=0.4.5
F5 Nginx=0.4.6
F5 Nginx=0.4.7
F5 Nginx=0.4.8
F5 Nginx=0.4.9
F5 Nginx=0.4.10
F5 Nginx=0.4.11
F5 Nginx=0.4.12
F5 Nginx=0.4.13
F5 Nginx=0.5.0
F5 Nginx=0.5.1
F5 Nginx=0.5.2
F5 Nginx=0.5.3
F5 Nginx=0.5.4
F5 Nginx=0.5.5
F5 Nginx=0.5.6
F5 Nginx=0.5.7
F5 Nginx=0.5.8
F5 Nginx=0.5.9
F5 Nginx=0.5.10
F5 Nginx=0.5.11
F5 Nginx=0.5.12
F5 Nginx=0.5.13
F5 Nginx=0.5.14
F5 Nginx=0.5.15
F5 Nginx=0.5.16
F5 Nginx=0.5.17
F5 Nginx=0.5.18
F5 Nginx=0.5.19
F5 Nginx=0.5.20
F5 Nginx=0.5.21
F5 Nginx=0.5.22
F5 Nginx=0.5.23
F5 Nginx=0.5.24
F5 Nginx=0.5.25
F5 Nginx=0.5.26
F5 Nginx=0.5.27
F5 Nginx=0.5.28
F5 Nginx=0.5.29
F5 Nginx=0.5.30
F5 Nginx=0.5.31
F5 Nginx=0.5.32
F5 Nginx=0.5.33
F5 Nginx=0.5.34
F5 Nginx=0.5.35
F5 Nginx=0.5.36
F5 Nginx=0.5.37
F5 Nginx=0.6.0
F5 Nginx=0.6.1
F5 Nginx=0.6.2
F5 Nginx=0.6.3
F5 Nginx=0.6.4
F5 Nginx=0.6.5
F5 Nginx=0.6.6
F5 Nginx=0.6.7
F5 Nginx=0.6.8
F5 Nginx=0.6.9
F5 Nginx=0.6.10
F5 Nginx=0.6.11
F5 Nginx=0.6.12
F5 Nginx=0.6.13
F5 Nginx=0.6.14
F5 Nginx=0.6.15
F5 Nginx=0.6.17
F5 Nginx=0.6.18
F5 Nginx=0.6.19
F5 Nginx=0.6.20
F5 Nginx=0.6.21
F5 Nginx=0.6.22
F5 Nginx=0.6.23
F5 Nginx=0.6.24
F5 Nginx=0.6.25
F5 Nginx=0.6.26
F5 Nginx=0.6.27
F5 Nginx=0.6.28
F5 Nginx=0.6.29
F5 Nginx=0.6.30
F5 Nginx=0.6.31
F5 Nginx=0.6.32
F5 Nginx=0.6.33
F5 Nginx=0.6.34
F5 Nginx=0.6.35
F5 Nginx=0.6.36
F5 Nginx=0.6.37
F5 Nginx=0.6.38
F5 Nginx=0.7.0
F5 Nginx=0.7.1
F5 Nginx=0.7.2
F5 Nginx=0.7.3
F5 Nginx=0.7.4
F5 Nginx=0.7.5
F5 Nginx=0.7.6
F5 Nginx=0.7.7
F5 Nginx=0.7.8
F5 Nginx=0.7.9
F5 Nginx=0.7.10
F5 Nginx=0.7.11
F5 Nginx=0.7.12
F5 Nginx=0.7.13
F5 Nginx=0.7.14
F5 Nginx=0.7.15
F5 Nginx=0.7.16
F5 Nginx=0.7.17
F5 Nginx=0.7.18
F5 Nginx=0.7.19
F5 Nginx=0.7.20
F5 Nginx=0.7.21
F5 Nginx=0.7.22
F5 Nginx=0.7.23
F5 Nginx=0.7.24
F5 Nginx=0.7.25
F5 Nginx=0.7.26
F5 Nginx=0.7.27
F5 Nginx=0.7.28
F5 Nginx=0.7.29
F5 Nginx=0.7.30
F5 Nginx=0.7.31
F5 Nginx=0.7.32
F5 Nginx=0.7.33
F5 Nginx=0.7.34
F5 Nginx=0.7.35
F5 Nginx=0.7.36
F5 Nginx=0.7.37
F5 Nginx=0.7.38
F5 Nginx=0.7.39
F5 Nginx=0.7.40
F5 Nginx=0.7.41
F5 Nginx=0.7.42
F5 Nginx=0.7.43
F5 Nginx=0.7.44
F5 Nginx=0.7.45
F5 Nginx=0.7.46
F5 Nginx=0.7.47
F5 Nginx=0.7.48
F5 Nginx=0.7.49
F5 Nginx=0.7.50
F5 Nginx=0.7.51
F5 Nginx=0.7.52
F5 Nginx=0.7.53
F5 Nginx=0.7.54
F5 Nginx=0.7.55
F5 Nginx=0.7.56
F5 Nginx=0.7.57
F5 Nginx=0.7.58
F5 Nginx=0.7.59
F5 Nginx=0.7.60
F5 Nginx=0.7.61
F5 Nginx=0.8.0
F5 Nginx=0.8.1
F5 Nginx=0.8.2
F5 Nginx=0.8.3
F5 Nginx=0.8.4
F5 Nginx=0.8.5
F5 Nginx=0.8.6
F5 Nginx=0.8.7
F5 Nginx=0.8.8
F5 Nginx=0.8.9
F5 Nginx=0.8.10
F5 Nginx=0.8.11
F5 Nginx=0.8.12
F5 Nginx=0.8.13
F5 Nginx=0.8.14
F5 Nginx=0.8.15
Nginx nginx=0.6.1516
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Nov 24, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3898?
CVE-2009-3898 is classified as a high severity vulnerability, allowing remote authenticated users to exploit directory traversal.
2
How do I fix CVE-2009-3898?
To fix CVE-2009-3898, upgrade to nginx version 0.7.63 or 0.8.17 or later, which includes the necessary patches.
3
What types of attacks are possible with CVE-2009-3898?
CVE-2009-3898 enables attackers to create or overwrite arbitrary files on the server via WebDAV operations.
4
Who is affected by CVE-2009-3898?
CVE-2009-3898 affects nginx versions prior to 0.7.63 and 0.8.x before 0.8.17.
5
What is the impact of exploiting CVE-2009-3898?
Exploiting CVE-2009-3898 can lead to unauthorized file manipulations, potentially compromising server security and integrity.