CVE-2009-2936

Estado: ModificadaAlta (7.5)—

The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives.

Leer descripción completaMostrar menos

NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 64%
Percentil entre todas las CVEs puntuadas: 99
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Varnish.projects.linpro — Varnish

CWE

CWE-287

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2009-2936",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-05T16:30:00.453",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040359.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510360/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510368/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.varnish-cache.org/changeset/3865",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.varnish-cache.org/wiki/CLI",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040359.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510360/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510368/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.varnish-cache.org/changeset/3865",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.varnish-cache.org/wiki/CLI",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives.  NOTE: the vendor disputes this report, saying that it is \"fundamentally misguided and pointless."
    },
    {
      "lang": "es",
      "value": "** DISPUTADA** La interfase de línea de comandos (también conocida como Server CLI o interfase de administración) en el proceso maestro en el \"reverse proxy server\" en Varnish anteriores a v2.1.0 no requiere autenticación para comandos recibidos a través del puerto TCP, lo que permite a atacantes remotos (1) ejecutar código de su elección a través de una directiva vcl.inline que provee un fichero de configuración código C; (2) cambiar el propietario del proceso maestro a través de directivas param.set, stop y start: (3) leer la línea iniciar de un fichero de su elección a través de la directiva vcl.load; o (4) conducir un ataque de falsificación de petición en sitios cruzados que muestren la localización de la víctima en una red segura y una validación de entrada impropia de directivas. NOTA: el desarollador disputa este informe diciendo que es \"equivocada y sin sentido\"."
    }
  ],
  "lastModified": "2026-06-16T23:10:32.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84D5B200-B3CE-4B3E-A64B-DEC2F1DFBA74"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:0.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "163F7D79-3CDE-4022-AE54-AF4EB1E2BCDB"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33A9C306-D088-477A-B5B1-A840083367C4"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E59746B-600B-4086-B9DA-CC24C5D5C16D"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A70BA8DB-D016-4970-9026-A86A96CFEBAB"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A502A298-F6E6-4E37-9CF1-CBD6AC9E36E6"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58BD6EC1-A38B-4761-BFC7-B0393C2FE48B"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D073F3A-4EBD-4144-B394-6DC998061CEE"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C33268B6-8F60-4502-9ECC-4F8465FA0AD8"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9BC6E22-867E-4A2F-92EC-177611047245"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D1A460C-DBD9-4D08-B835-6897F6DA3611"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C0DB8AF-F472-41CD-9CCD-A295B5517894"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F92062C5-6288-4244-B786-4621CC16A188"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B559DD9-1FD3-45CB-8070-A899E9FADE16"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44BEBA6C-F548-416F-8507-9578857ED384"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7066D53C-8A0E-4875-9931-C593865AF6E4"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F6CFA79-0172-47FB-9328-0278D1C3CC71"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2F74286-4A7B-44B9-9AB1-CF39046F9D01"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FFFD248-824B-47BE-AE16-A433E3C8AD56"
            },
            {
              "criteria": "cpe:2.3:a:varnish.projects.linpro:varnish:2.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7EE367F-581D-41CC-A92C-699B7E6704E4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}