CVE-2009-3898

The record

Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.

Affected packages

Related vulnerabilities

• CVE-2009-4487 nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which… Also affects nginx
• CVE-2009-2629 Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before… Also affects nginx
• CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow… Also affects nginx
• CVE-2016-1247 The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before… Also affects nginx
• CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote… Also affects nginx
• CVE-2016-0742 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… Also affects nginx
• CVE-2014-3616 nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or… Also affects nginx
• CVE-2013-4547 nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass… Also affects nginx