CVE-2009-3902: Path Traversal
Published Nov 6, 2009
·Updated
Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.
Affected Software
4 affected components
All of the following
Cherokee Cherokee HTTPD=0.5.4
Microsoft Windows
Cherokee Cherokee HTTPD=0.5.4
Microsoft Windows
Event History
Nov 6, 2009
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
03:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-3902?
CVE-2009-3902 is classified as a medium severity vulnerability due to its potential to allow unauthorized file access.
2
How do I fix CVE-2009-3902?
To fix CVE-2009-3902, upgrade to Cherokee Web Server version 0.5.5 or later, which contains patches for this vulnerability.
3
Which versions of Cherokee Web Server are affected by CVE-2009-3902?
CVE-2009-3902 affects Cherokee Web Server versions 0.5.4 and earlier.
4
What type of attack does CVE-2009-3902 allow?
CVE-2009-3902 allows remote attackers to perform directory traversal attacks to read arbitrary files on the server.
5
Can CVE-2009-3902 be exploited remotely?
Yes, CVE-2009-3902 can be exploited remotely, making it critical to address this vulnerability promptly.