Back to CVE Browser

CVE-2009-4372

HIGH

7.5

CVSS Severity Score

EPSS Score0.0210%

EPSS Percentile4.37th

PublishedDec 21, 2009

Last ModifiedApr 23, 2026

Vulnerability Description

AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to (1) wcl.php, (2) storage_graphs.php, (3) storage_graphs2.php, (4) storage_graphs3.php, and (5) storage_graphs4.php in sem/.

Affected Platforms (CPE)

📦

Alienvault

Open Source Security Information Management

= 2.1.5

📦

Alienvault

Open Source Security Information Management

= 2.1.5-1

📦

Alienvault

Open Source Security Information Management

= 2.1.5-2

📦

Alienvault

Open Source Security Information Management

= 2.1.5-3

References & Advisories

🔗 http://osvdb.org/61151

🔗 http://osvdb.org/61152

🔗 http://osvdb.org/61153

🔗 http://osvdb.org/61154

🔗 http://osvdb.org/61155

🔗 http://secunia.com/advisories/37727

🔗 http://www.alienvault.com/community.php?section=News

🔗 http://www.cybsec.com/vuln/OSSIM_2_1_5_Remote_Command_Execution.pdf

Related Vulnerabilities

CVE-2009-43747.5

Directory traversal vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Managemen...

CVE-2009-43757.5

SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSS...

CVE-2009-43737.5

Unrestricted file upload vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Mana...

CVE-2013-53217.5

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attacker...