« Volver al listado

CVE-2009-4644

Estado: ModificadaAlta (9)—

Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Accellion — Secure File Transfer Appliance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4644",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-02-19T17:30:00.473",
  "references": [
    {
      "url": "http://www.portcullis-security.com/338.php",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/38176",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56248",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.portcullis-security.com/338.php",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38176",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56248",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program."
    },
    {
      "lang": "es",
      "value": "Accellion Secure File Transfer Appliance anterior a v8_0_105 permite a los administradores remotos autenticados evitar el shell restringido y ejecutar comandos a su elección mediante metacaracteres en el comando ping, como lo demuestra la modificación del programa cli."
    }
  ],
  "lastModified": "2026-06-16T23:14:05.257",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_135:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59DB02D8-8C89-48C6-9365-1AA8FEB88C15"
            },
            {
              "criteria": "cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_178:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6346A19A-A191-4EFA-A3F2-DF030BD417FF"
            },
            {
              "criteria": "cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_189:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2916296B-1468-478F-91A9-48B040795AC4"
            },
            {
              "criteria": "cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_259:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B04D3329-1966-4867-A594-228417554E46"
            },
            {
              "criteria": "cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_296:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E4B98B8-7BD2-401F-BC12-6A0120FB950E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}