| Vulnerability Name: | CVE-2009-0759 (CCN-48891) | ||||||||||||||||
| Assigned: | 2009-02-24 | ||||||||||||||||
| Published: | 2009-02-24 | ||||||||||||||||
| Updated: | 2009-06-09 | ||||||||||||||||
| Summary: | Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors. | ||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||
| CVSS v2 Severity: | 6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P) 4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||
| Vulnerability Type: | CWE-94 | ||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2009-0759 Source: CCN Type: ZNC Changelog ZNC Source: OSVDB Type: UNKNOWN 52295 Source: CCN Type: SA34043 ZNC webadmin Configuration File Manipulation Vulnerability Source: SECUNIA Type: UNKNOWN 34230 Source: DEBIAN Type: UNKNOWN DSA-1735 Source: DEBIAN Type: DSA-1735 znc -- missing input sanitization Source: CCN Type: GLSA-200903-02 ZNC: Privilege escalation Source: MLIST Type: UNKNOWN [oss-security] 20090301 CVE id request: znc Source: CCN Type: OSVDB ID: 52295 ZNC Webadmin Module znc.conf QuitMessage Field Security Restriction Bypass Source: CCN Type: BID-33899 ZNC Webadmin Module Remote Privilege Escalation Vulnerability Source: CONFIRM Type: Vendor Advisory http://znc.svn.sourceforge.net/viewvc/znc/trunk/modules/webadmin.cpp?view=log&sortby=rev&sortdir=down&pathrev=1395 Source: CONFIRM Type: Vendor Advisory http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1395 Source: CONFIRM Type: Vendor Advisory http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1396 Source: XF Type: UNKNOWN znc-webadmin-privilege-escalation(48891) | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||