Lucene search

[email protected]CVE-2009-4417

HistoryOct 03, 2022 - 4:24 p.m.

CVE-2009-4417

2022-10-0316:24:05

CWE-264

[email protected]

web.nvd.nist.gov

cve-2009-4417

zend_framework

vulnerability

shutdown function

zend_log_writer_mail

nvd

arbitrary

mailing vectors

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.8%

JSON

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to “events not yet mailed.”

Affected configurations

NVD

Node

zendframeworkRange≤1.9.6

zendframeworkMatch0.1.3preview

zendframeworkMatch0.1.4preview

zendframeworkMatch0.1.5preview

zendframeworkMatch0.2.0preview

zendframeworkMatch0.6.0preview

zendframeworkMatch0.7.0preview

zendframeworkMatch0.8.0preview

zendframeworkMatch0.9.0beta

zendframeworkMatch0.9.1beta

zendframeworkMatch0.9.2beta

zendframeworkMatch0.9.3beta

zendframeworkMatch1.0.0

zendframeworkMatch1.0.0rc1

zendframeworkMatch1.0.0rc2

zendframeworkMatch1.0.0rc3

zendframeworkMatch1.0.1

zendframeworkMatch1.0.2

zendframeworkMatch1.0.3

zendframeworkMatch1.0.4

zendframeworkMatch1.5.0

zendframeworkMatch1.5.0preview

zendframeworkMatch1.5.0rc1

zendframeworkMatch1.5.0rc2

zendframeworkMatch1.5.0rc3

zendframeworkMatch1.5.1

zendframeworkMatch1.5.2

zendframeworkMatch1.5.3

zendframeworkMatch1.6.0

zendframeworkMatch1.6.0rc1

zendframeworkMatch1.6.0rc2

zendframeworkMatch1.6.0rc3

zendframeworkMatch1.6.1

zendframeworkMatch1.6.2

zendframeworkMatch1.7.0

zendframeworkMatch1.7.0preview

zendframeworkMatch1.7.1

zendframeworkMatch1.7.2

zendframeworkMatch1.7.3

zendframeworkMatch1.7.4

zendframeworkMatch1.7.5

zendframeworkMatch1.7.6

zendframeworkMatch1.7.7

zendframeworkMatch1.7.8

zendframeworkMatch1.8.0

zendframeworkMatch1.8.0alpha_1

zendframeworkMatch1.8.0beta_1

zendframeworkMatch1.8.1

zendframeworkMatch1.8.2

zendframeworkMatch1.8.3

zendframeworkMatch1.8.4

zendframeworkMatch1.9

zendframeworkMatch1.9.0

zendframeworkMatch1.9.0alpha_1

zendframeworkMatch1.9.0beta_1

zendframeworkMatch1.9.0rc1

zendframeworkMatch1.9.1

zendframeworkMatch1.9.2

zendframeworkMatch1.9.3

zendframeworkMatch1.9.4

zendframeworkMatch1.9.5

CPENameOperatorVersion
zend:frameworkzend frameworkle1.9.6
zend:frameworkzend frameworkeq0.1.3
zend:frameworkzend frameworkeq0.1.4
zend:frameworkzend frameworkeq0.1.5
zend:frameworkzend frameworkeq0.2.0
zend:frameworkzend frameworkeq0.6.0
zend:frameworkzend frameworkeq0.7.0
zend:frameworkzend frameworkeq0.8.0
zend:frameworkzend frameworkeq0.9.0
zend:frameworkzend frameworkeq0.9.1

CPE	Name	Operator	Version
zend:framework	zend framework	le	1.9.6
zend:framework	zend framework	eq	0.1.3
zend:framework	zend framework	eq	0.1.4
zend:framework	zend framework	eq	0.1.5
zend:framework	zend framework	eq	0.2.0
zend:framework	zend framework	eq	0.6.0
zend:framework	zend framework	eq	0.7.0
zend:framework	zend framework	eq	0.8.0
zend:framework	zend framework	eq	0.9.0
zend:framework	zend framework	eq	0.9.1

Rows per page:

1-10 of 451

References

www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/

www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.8%

JSON

Related for CVE-2009-4417

prion1 nvd1 cvelist1