CVE-2009-4896

{"id": "CVE-2009-4896", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-08-02T20:40:00.217", "references": [{"url": "http://bugs.gentoo.org/show_bug.cgi?id=259968", "source": "secalert@redhat.com"}, {"url": "http://mlmmj.org/node/84", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/40658", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2010/dsa-2073", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/06/23/5", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/06/23/6", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/06/25/2", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/06/26/1", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/07/04/4", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2010/07/06/1", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=607256", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en la interfaz web mlmmj-php-admin para Mailing List Managing Made Joyful (mlmmj) 1.2.15 a 1.2.17, permiten a atacantes remotos autenticados sobrescribir, crear o borrar ficheros de su elecci\u00f3n, o conocer la existencia de directorios de su elecci\u00f3n mediante un .. (punto punto) en un nombre de lista en una acci\u00f3n (1) edit o (2) save."}], "lastModified": "2010-08-03T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mlmmj:mlmmj:1.2.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5394054E-1693-4639-972C-222DCCC39AAA"}, {"criteria": "cpe:2.3:a:mlmmj:mlmmj:1.2.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19BD6525-7D22-4A43-914B-97E755D99E42"}, {"criteria": "cpe:2.3:a:mlmmj:mlmmj:1.2.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64B9843D-5D0D-4E49-BF16-11CF7187D771"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}