CVE-2009-3095: apache http_server
Vulnerability summary
CVE-2009-3095 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 13.55% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 08-09-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.55%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 13.55% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- apache2< 2.2.13-2
- debian_linuxEOL4.0
Suse2 products
- linux_enterprise_desktop10:sp2 | 10:sp3
- linux_enterprise_server9 | 10:sp2 | 10:sp3 | 11
Apache1 product
- http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.14
Apple1 product
- mac_os_x< 10.6.3
Fedoraproject1 product
- fedoraEOL10 | 12
Opensuse1 product
- opensuseEOL10.3 | 11.0 | 11.1
6 vendors · 8 products
References
40 links- lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662VDB EntrySignatureX Refsource OVALThird Party Advisory
- marc.info?l=bugtraq&m=127557640302499&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- marc.info?l=bugtraq&m=130497311408250&w=2Vendor AdvisoryX Refsource HPNot ApplicableThird Party Advisory
- marc.info?l=bugtraq&m=126998684522511&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- www.securityfocus.com/archive/1/508075/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
Show all 40 references
- marc.info?l=bugtraq&m=133355494609819&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory