CVE-2009-4530: Infoleak
Published Dec 31, 2009
·Updated
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI.
Affected Software
2 affected components
Sergey Lyubka Mongoose<=2.8
Sergey Lyubka Mongoose=2.4
Event History
Dec 31, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4530?
CVE-2009-4530 is considered to have a medium severity due to the potential exposure of sensitive source code.
2
How do I fix CVE-2009-4530?
To fix CVE-2009-4530, upgrade to Mongoose version 2.9.0 or later, which addresses this vulnerability.
3
Which versions of Mongoose are affected by CVE-2009-4530?
Mongoose versions 2.8.0 and earlier are affected by CVE-2009-4530.
4
What kind of attack does CVE-2009-4530 enable?
CVE-2009-4530 allows remote attackers to disclose the source code of web pages served by the Mongoose web server.
5
Is there a workaround for CVE-2009-4530 if I cannot upgrade?
A potential workaround for CVE-2009-4530 is to configure the server to disallow URIs that include ::$DATA.