Home

CVE-2009-4487

Description

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a windows title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
2.235

Associated Vulnerability

VulnerabilityOS Platform
Update Nginx to 9.1.19Windows
Update Nginx to 9.1.5Windows
Update Nginx to 9.1.8Windows
Update Nginx to 9.2.14Windows
Update Nginx to 9.2.19Windows
Update Nginx to 9.2.3Windows
Update Nginx to 9.2.7Windows
Update Nginx to 9.3.10Windows
Update Nginx to 9.3.15Windows
Update Nginx to 9.3.17Windows
Update Nginx to 9.1.19 (For Linux)Linux
Update Nginx to 9.1.5 (For Linux)Linux
Update Nginx to 9.1.8 (For Linux)Linux
Update Nginx to 9.2.14 (For Linux)Linux
Update Nginx to 9.2.19 (For Linux)Linux
Update Nginx to 9.2.3 (For Linux)Linux
Update Nginx to 9.2.7 (For Linux)Linux
Update Nginx to 9.3.10 (For Linux)Linux
Update Nginx to 9.3.15 (For Linux)Linux
Update Nginx to 9.3.17 (For Linux)Linux
CVE-2009-4487NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234