CVE-2009-3902

Cherokee Web Server <0.5.4 - Path Traversal

Title source: llm

Description

Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Dr_IDE · textwebappswindows

https://www.exploit-db.com/exploits/9873

View Code ZIP pw:eip

References (7)

[Exploit, URL Repurposed] http://freetexthost.com/ncyss3plli

[Exploit] http://osvdb.org/59588

[Exploit] http://pocoftheday.blogspot.com/2009/10/cherokee-web-server-054-directory.html

[Vendor Advisory] http://secunia.com/advisories/37183

[Exploit] http://www.securityfocus.com/bid/36874

[Vendor Advisory] http://www.vupen.com/english/advisories/2009/3091

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/54024

Scores

EPSS 0.0727

EPSS Percentile 91.5%

Classification

CWE

CWE-22

Status draft

Affected Products (1)

cherokee/cherokee_httpd

Timeline

Published Nov 06, 2009

Tracked Since Feb 18, 2026