Back to CVE Browser

CVE-2009-4373

HIGH

7.5

CVSS Severity Score

EPSS Score0.0170%

EPSS Percentile1.83th

PublishedDec 21, 2009

Last ModifiedApr 23, 2026

Vulnerability Description

Unrestricted file upload vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in ossiminstall/uploads/.

Affected Platforms (CPE)

📦

Alienvault

Open Source Security Information Management

= 2.1.5

📦

Alienvault

Open Source Security Information Management

= 2.1.5-1

📦

Alienvault

Open Source Security Information Management

= 2.1.5-2

📦

Alienvault

Open Source Security Information Management

= 2.1.5-3

References & Advisories

🔗 http://secunia.com/advisories/37727

🔗 http://www.alienvault.com/community.php?section=News

🔗 http://www.cybsec.com/vuln/OSSIM_2_1_5%20_Arbitrary_File_Upload.pdf

🔗 http://secunia.com/advisories/37727

🔗 http://www.alienvault.com/community.php?section=News

🔗 http://www.cybsec.com/vuln/OSSIM_2_1_5%20_Arbitrary_File_Upload.pdf

Related Vulnerabilities

CVE-2009-43747.5

Directory traversal vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Managemen...

CVE-2009-43757.5

SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSS...

CVE-2009-43727.5

AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote at...

CVE-2013-53217.5

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attacker...