Skip to content
Back to search

CVE-2009-4487

MEDIUM
6.8NVD

Summary

generated automatically from NVD data

nginx 0.7.64 writes request data to its log file without sanitizing non-printable characters. A remote attacker can send an HTTP request containing a terminal emulator escape sequence, which may alter a window's title when the log is viewed. It could possibly also lead to arbitrary command execution or file overwriting. The flaw has a CVSS v2.0 score of 6.8 (MEDIUM).

NVD description

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Share:

EPSS · FIRST.org

26.8%probability of exploitation in the next 30 days

Higher than 98% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-01, recomputed daily by FIRST.org.

CVSS v2.0 Score

6.8
/ 10.0
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P

Information

Published
13 janv. 2010
Updated
16 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

f5 nginxAll nginx CVEs →
Versions 0.7.64

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

NVD-CWE-noinfo

References (6)

Similar CVEs

Other vulnerabilities of type

…

Running nginx? Know which CVEs hit your version.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Watch my nginxI already have an account