CVE-2009-4417

Published: Dec 24, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."

Affected (61)

Products: Zend: Framework

Zend

1 product

Framework

Configuration A

61 vulnerable

Vulnerable Software	Affected Versions
Zend Framework	Up to 1.9.6
Zend Framework	Version 0.1.3 preview
Zend Framework	Version 0.1.4 preview
Zend Framework	Version 0.1.5 preview
Zend Framework	Version 0.2.0 preview
Zend Framework	Version 0.6.0 preview
Zend Framework	Version 0.7.0 preview
Zend Framework	Version 0.8.0 preview
Zend Framework	Version 0.9.0 beta
Zend Framework	Version 0.9.1 beta
Zend Framework	Version 0.9.2 beta
Zend Framework	Version 0.9.3 beta
Zend Framework	Version 1.0.0
Zend Framework	Version 1.0.0 rc1
Zend Framework	Version 1.0.0 rc2
Zend Framework	Version 1.0.0 rc3
Zend Framework	Version 1.0.1
Zend Framework	Version 1.0.2
Zend Framework	Version 1.0.3
Zend Framework	Version 1.0.4
Zend Framework	Version 1.5.0
Zend Framework	Version 1.5.0 preview
Zend Framework	Version 1.5.0 rc1
Zend Framework	Version 1.5.0 rc2
Zend Framework	Version 1.5.0 rc3
Zend Framework	Version 1.5.1
Zend Framework	Version 1.5.2
Zend Framework	Version 1.5.3
Zend Framework	Version 1.6.0
Zend Framework	Version 1.6.0 rc1
Zend Framework	Version 1.6.0 rc2
Zend Framework	Version 1.6.0 rc3
Zend Framework	Version 1.6.1
Zend Framework	Version 1.6.2
Zend Framework	Version 1.7.0
Zend Framework	Version 1.7.0 preview
Zend Framework	Version 1.7.1
Zend Framework	Version 1.7.2
Zend Framework	Version 1.7.3
Zend Framework	Version 1.7.4
Zend Framework	Version 1.7.5
Zend Framework	Version 1.7.6
Zend Framework	Version 1.7.7
Zend Framework	Version 1.7.8
Zend Framework	Version 1.8.0
Zend Framework	Version 1.8.0 alpha_1
Zend Framework	Version 1.8.0 beta_1
Zend Framework	Version 1.8.1
Zend Framework	Version 1.8.2
Zend Framework	Version 1.8.3
Zend Framework	Version 1.8.4
Zend Framework	Version 1.9.0
Zend Framework	Version 1.9.0 alpha_1
Zend Framework	Version 1.9.0 beta_1
Zend Framework	Version 1.9.0 rc1
Zend Framework	Version 1.9.1
Zend Framework	Version 1.9.2
Zend Framework	Version 1.9.3
Zend Framework	Version 1.9.4
Zend Framework	Version 1.9.5
Zend Framework	Version 1.9

Related CWEs

CWE-264

References (4)

http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/

Source: cve@mitre.org

Exploit

http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/

Source: cve@mitre.org

Exploit

http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.