CVE-2009-2265

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-07-03T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-06-24T19:06:14.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2009-1825", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1825"}, {"tags": ["x_refsource_MISC"], "url": "http://www.ocert.org/advisories/ocert-2009-007.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://sourceforge.net/project/shownotes.php?release_id=695430"}, {"name": "35909", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35909"}, {"name": "DSA-1836", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2009/dsa-1836"}, {"name": "FEDORA-2009-7761", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html"}, {"name": "35833", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35833"}, {"name": "ADV-2009-1813", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1813"}, {"name": "[Zope-dev] 20090706 zope.html with FCKEditor security fix", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html"}, {"name": "1022513", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022513"}, {"tags": ["x_refsource_MISC"], "url": "http://isc.sans.org/diary.html?storyid=6724"}, {"name": "20090703 [oCERT-2009-007] FCKeditor input sanitization errors", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded"}, {"name": "FEDORA-2009-7794", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-2265", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2009-1825", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1825"}, {"name": "http://www.ocert.org/advisories/ocert-2009-007.html", "refsource": "MISC", "url": "http://www.ocert.org/advisories/ocert-2009-007.html"}, {"name": "http://sourceforge.net/project/shownotes.php?release_id=695430", "refsource": "CONFIRM", "url": "http://sourceforge.net/project/shownotes.php?release_id=695430"}, {"name": "35909", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35909"}, {"name": "DSA-1836", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2009/dsa-1836"}, {"name": "FEDORA-2009-7761", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html"}, {"name": "35833", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35833"}, {"name": "ADV-2009-1813", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1813"}, {"name": "[Zope-dev] 20090706 zope.html with FCKEditor security fix", "refsource": "MLIST", "url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html"}, {"name": "1022513", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022513"}, {"name": "http://isc.sans.org/diary.html?storyid=6724", "refsource": "MISC", "url": "http://isc.sans.org/diary.html?storyid=6724"}, {"name": "20090703 [oCERT-2009-007] FCKeditor input sanitization errors", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded"}, {"name": "FEDORA-2009-7794", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html"}, {"name": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:44:55.927Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2009-1825", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/1825"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.ocert.org/advisories/ocert-2009-007.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://sourceforge.net/project/shownotes.php?release_id=695430"}, {"name": "35909", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35909"}, {"name": "DSA-1836", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2009/dsa-1836"}, {"name": "FEDORA-2009-7761", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html"}, {"name": "35833", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35833"}, {"name": "ADV-2009-1813", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/1813"}, {"name": "[Zope-dev] 20090706 zope.html with FCKEditor security fix", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html"}, {"name": "1022513", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1022513"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://isc.sans.org/diary.html?storyid=6724"}, {"name": "20090703 [oCERT-2009-007] FCKeditor input sanitization errors", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded"}, {"name": "FEDORA-2009-7794", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-2265", "datePublished": "2009-07-05T16:00:00.000Z", "dateReserved": "2009-06-29T00:00:00.000Z", "dateUpdated": "2024-08-07T05:44:55.927Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fckeditor:fckeditor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A935AD9-DB0B-47A9-8F5E-9FF2A3310865", "versionEndIncluding": "2.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8A396BB3-7329-4522-8C5F-99CCA41C9DA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0_fc:*:*:*:*:*:*:*", "matchCriteriaId": "97BEB138-2E35-4770-BA2B-D78FFC6E6CE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0_rc2:*:*:*:*:*:*:*", "matchCriteriaId": "DD08F2AA-D782-419D-945C-D241EB18CBB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0rc2:*:*:*:*:*:*:*", "matchCriteriaId": "B6F9F4D2-0A3E-49D6-9A58-D9BCDF492E90", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0rc3:*:*:*:*:*:*:*", "matchCriteriaId": "CF47BD2F-7AC9-490E-9289-9C259FE4F231", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "490C6198-FDA6-45BF-B12F-6F9A52B6F1C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "83806F80-BA69-4098-A4F6-1F9577871EBD", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "D2823302-CCF1-438B-B962-6EE49D371A28", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3:*:*:*:*:*:*:*", "matchCriteriaId": "43FBB64C-5D5D-43D0-A4B9-B08F0012B9D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3:beta:*:*:*:*:*:*", "matchCriteriaId": "28B4FB08-9605-4D05-98B6-844F701BFA35", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "95BF5CD1-7D68-4FBE-8116-23B4D1415B03", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "EE69FFCF-D442-492F-A5F6-56A02E4E9299", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "31A4C3CC-27E5-4962-85B2-404EAF434B11", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4:*:*:*:*:*:*:*", "matchCriteriaId": "665C47D7-40EC-4F52-8EA0-0886EE8A9345", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "2271D898-7973-412C-8EA2-EBFD22ABF25E", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "6834FFFF-F463-4F01-BB13-46705B9933A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "68C583B7-5A09-4849-A1E1-600C87854A24", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5:*:*:*:*:*:*:*", "matchCriteriaId": "F45886E0-9D00-42B4-AF12-87EFED09765C", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5:beta:*:*:*:*:*:*", "matchCriteriaId": "72159C7B-3F8E-440F-8248-3A5A991957B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "631C1D5A-191E-40D7-A6E4-25C184314527", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6:*:*:*:*:*:*:*", "matchCriteriaId": "2D47CE1F-04A6-4961-B0B3-5A3EC403EE14", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "2A2C7527-3513-4B72-8C8D-295A3A8BAD2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "E18F60E3-3723-40F3-A632-C3B8B6157682", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "E99B8429-1EBC-483D-87B6-281E2C49E35A", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.3:beta:*:*:*:*:*:*", "matchCriteriaId": "05B5740F-05C0-4155-BC11-50DE6F8285DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.4:beta:*:*:*:*:*:*", "matchCriteriaId": "B9D86941-B839-43CC-A97E-CA52339A9871", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en FCKeditor anterior a v2.6.4.1, permiten a atacantes remotos crear ficheros ejecutables en directorios de su elecci\u00f3n a trav\u00e9s de secuencias de salto de directorio en la entrada de m\u00f3dulos conectores no especificados, tal como se ha explotado en Julio 2009. Est\u00e1 relacionado con el fichero de navegaci\u00f3n y el directorio editor/filemanager/connectors/."}], "id": "CVE-2009-2265", "lastModified": "2026-06-16T23:09:05.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-07-05T16:30:00.377", "references": [{"source": "cve@mitre.org", "url": "http://isc.sans.org/diary.html?storyid=6724"}, {"source": "cve@mitre.org", "url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html"}, {"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/35833"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/35909"}, {"source": "cve@mitre.org", "url": "http://sourceforge.net/project/shownotes.php?release_id=695430"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2009/dsa-1836"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.ocert.org/advisories/ocert-2009-007.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1022513"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/1813"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/1825"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://isc.sans.org/diary.html?storyid=6724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/35833"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/35909"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://sourceforge.net/project/shownotes.php?release_id=695430"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2009/dsa-1836"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.ocert.org/advisories/ocert-2009-007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1022513"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2009/1813"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2009/1825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "moin: embedded fckeditor multiple directory traversal vulns", "id": "509924", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=509924"}, "csaw": false, "details": ["Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory."], "name": "CVE-2009-2265", "public_date": "2009-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-2265"], "threat_severity": "Important"}

{}