Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
References
Configurations
Configuration 1 (hide)
|
Information
Published : 2009-11-24 09:30
Updated : 2021-11-10 07:52
NVD link : CVE-2009-3898
Mitre link : CVE-2009-3898
JSON object : View
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Products Affected
nginx
- nginx
f5
- nginx