Description

header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Remediation

References

CVE-2009-4489

Related Vulnerabilities

Ruby on Rails Inefficient Regular Expression Complexity Vulnerability (CVE-2023-22792)

WordPress Plugin Post Type Switcher Multiple Unspecified Vulnerabilities (1.5.0)

WordPress Plugin Good LMS-Learning Management System SQL Injection (2.1.4)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2011-0708)

SharePoint Numeric Truncation Error Vulnerability (CVE-2026-55142)

Severity

Medium

Classification

CVE-2009-4489 CWE-20

Tags

Missing Update Known Vulnerabilities