CVE-2009-3890 - Vulnerability Details - OpenCVE

Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.10487.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress Subscribe	Wordpress Subscribe

Configuration 1 [-]

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html
http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html
http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html
http://core.trac.wordpress.org/ticket/11122
http://secunia.com/advisories/37332
http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/
http://www.openwall.com/lists/oss-security/2009/11/15/2
http://www.openwall.com/lists/oss-security/2009/11/15/3
http://www.openwall.com/lists/oss-security/2009/11/16/1
http://www.osvdb.org/59958

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2009-11-17T18:00:00Z

Updated: 2024-09-16T23:46:39.551Z

Reserved: 2009-11-05T00:00:00Z

Link: CVE-2009-3890

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-11-17T18:30:00.313

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-3890

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-94

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-11-17T18:00:00Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "37332", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37332"}, {"name": "[oss-security] 20091116 Re: CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/1"}, {"name": "20091111 WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html"}, {"name": "[oss-security] 20091115 Re: CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/3"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://core.trac.wordpress.org/ticket/11122"}, {"name": "59958", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/59958"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html"}, {"name": "[oss-security] 20091115 CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2009-3890", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "37332", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37332"}, {"name": "[oss-security] 20091116 Re: CVE request: Wordpress 2.8.6", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/11/16/1"}, {"name": "20091111 WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html"}, {"name": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/", "refsource": "CONFIRM", "url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html"}, {"name": "[oss-security] 20091115 Re: CVE request: Wordpress 2.8.6", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/11/15/3"}, {"name": "http://core.trac.wordpress.org/ticket/11122", "refsource": "CONFIRM", "url": "http://core.trac.wordpress.org/ticket/11122"}, {"name": "59958", "refsource": "OSVDB", "url": "http://www.osvdb.org/59958"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html"}, {"name": "[oss-security] 20091115 CVE request: Wordpress 2.8.6", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/11/15/2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:45:49.708Z"}, "title": "CVE Program Container", "references": [{"name": "37332", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37332"}, {"name": "[oss-security] 20091116 Re: CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/1"}, {"name": "20091111 WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html"}, {"name": "[oss-security] 20091115 Re: CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/3"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://core.trac.wordpress.org/ticket/11122"}, {"name": "59958", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/59958"}, {"name": "20091112 Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html"}, {"name": "[oss-security] 20091115 CVE request: Wordpress 2.8.6", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/2"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2009-3890", "datePublished": "2009-11-17T18:00:00Z", "dateReserved": "2009-11-05T00:00:00Z", "dateUpdated": "2024-09-16T23:46:39.551Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "E33698FD-9A82-413F-BADD-8E0719BB70A9", "versionEndIncluding": "2.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename."}, {"lang": "es", "value": "Vulnerabilidad de subida de archivos sin restricci\u00f3n en la funci\u00f3n wp_check_filetype en wp-includes/functions.php en WordPress anteriores a v2.8.6, cuando cierta configuraci\u00f3n del modulo mod_mime en el servidor HTTP Apache esta activado, permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario posteando un adjunto con un nombre de fichero con m\u00faltiples extensiones y luego accediendo a el a trav\u00e9s de una petici\u00f3n directa al nombre de ruta wp-content/uploads/, como se demuestra con el nombre de fichero .php.jpg."}], "id": "CVE-2009-3890", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-11-17T18:30:00.313", "references": [{"source": "secalert@redhat.com", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html"}, {"source": "secalert@redhat.com", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html"}, {"source": "secalert@redhat.com", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "http://core.trac.wordpress.org/ticket/11122"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/37332"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/2"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/3"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/1"}, {"source": "secalert@redhat.com", "tags": ["Broken Link"], "url": "http://www.osvdb.org/59958"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "http://core.trac.wordpress.org/ticket/11122"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/37332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://www.osvdb.org/59958"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}