Back to Database
Status published
High
CVE-2009-2444
Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and...
Vulnerability Description
Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-2444
Credits & Attribution
No credits recorded in the NVD database.
References
- http://r00tsecurity.org/forums/index.php?showtopic=9460
- http://www.vupen.com/english/advisories/2009/1808
- http://sourceforge.net/project/shownotes.php?release_id=694644
- http://sourceforge.net/apps/mantisbt/adbnewssender/view.php?id=22
- http://www.securityfocus.com/bid/35596
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51720
- http://secunia.com/advisories/35845
Affected Vendor
adbnewssender
View all reports →Affected Software
adbnewssender
Vulnerable Versions:
0, 1.0, 1.1, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.11, 1.5.0, 1.5.1, 1.5.2, 2.0
Timeline
Official Publish:
July 13th, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.