CVE-2009-4415 - Vulnerability Details - OpenCVE

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phpgroupware	Phpgroupware

Configuration 1 [-]

cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.12:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/35519
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117
http://www.openwall.com/lists/oss-security/2009/12/20/1
http://www.osvdb.org/56177
http://www.osvdb.org/56180
http://www.securityfocus.com/bid/35761
https://exchange.xforce.ibmcloud.com/vulnerabilities/51921
https://exchange.xforce.ibmcloud.com/vulnerabilities/51924

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-12-24T16:00:00

Updated: 2024-08-07T07:01:20.269Z

Reserved: 2009-12-24T00:00:00

Link: CVE-2009-4415

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-12-24T16:30:00.453

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-4415

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-07-22T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35761", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/35761"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "phpgroupware-convtype-file-include(51924)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51924"}, {"name": "56180", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/56180"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117"}, {"name": "35519", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35519"}, {"name": "phpgroupware-csvimport-info-disclosure(51921)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51921"}, {"name": "56177", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/56177"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "[oss-security] 20091220 CVE request: phpgroupware", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/12/20/1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-4415", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35761", "refsource": "BID", "url": "http://www.securityfocus.com/bid/35761"}, {"name": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware", "refsource": "CONFIRM", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "phpgroupware-convtype-file-include(51924)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51924"}, {"name": "56180", "refsource": "OSVDB", "url": "http://www.osvdb.org/56180"}, {"name": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117", "refsource": "CONFIRM", "url": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117"}, {"name": "35519", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35519"}, {"name": "phpgroupware-csvimport-info-disclosure(51921)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51921"}, {"name": "56177", "refsource": "OSVDB", "url": "http://www.osvdb.org/56177"}, {"name": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware", "refsource": "CONFIRM", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware", "refsource": "CONFIRM", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "[oss-security] 20091220 CVE request: phpgroupware", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/12/20/1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:01:20.269Z"}, "title": "CVE Program Container", "references": [{"name": "35761", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/35761"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "phpgroupware-convtype-file-include(51924)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51924"}, {"name": "56180", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/56180"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117"}, {"name": "35519", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35519"}, {"name": "phpgroupware-csvimport-info-disclosure(51921)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51921"}, {"name": "56177", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/56177"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"name": "[oss-security] 20091220 CVE request: phpgroupware", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/12/20/1"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-4415", "datePublished": "2009-12-24T16:00:00", "dateReserved": "2009-12-24T00:00:00", "dateUpdated": "2024-08-07T07:01:20.269Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.12:*:*:*:*:*:*:*", "matchCriteriaId": "3C58F242-81C3-4739-B28D-2D2FD8F0DEE1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio phpGroupWare v0.9.16.12, y problemente otra versiones anteriores a v0.9.16.014, permite a atacantes remotos (1) leer ficheros de su elecci\u00f3n a trav\u00e9s del par\u00e1metro addressbook/csv_import.php, o (2) incluir y ejecutar ficheros locales de su elecci\u00f3n a trav\u00e9s del par\u00e1metro conv_type en addressbook/inc/class.uiXport.inc.php."}], "id": "CVE-2009-4415", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-24T16:30:00.453", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35519"}, {"source": "cve@mitre.org", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "cve@mitre.org", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "cve@mitre.org", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "cve@mitre.org", "url": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/12/20/1"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/56177"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/56180"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/35761"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51921"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51924"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35519"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/12/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/56177"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/56180"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/35761"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51921"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51924"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}