Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2009-11-24T17:00:00

Updated: 2024-08-07T06:45:51.019Z

Reserved: 2009-11-05T00:00:00

Link: CVE-2009-3898

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2009-11-24T17:30:00.437

Modified: 2021-11-10T15:52:55.790

Link: CVE-2009-3898

cve-icon Redhat

No data.