{"api_version":"1","generated_at":"2026-07-23T10:32:48+00:00","cve":"CVE-2009-1462","urls":{"html":"https://cve.report/CVE-2009-1462","api":"https://cve.report/api/cve/CVE-2009-1462.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-1462","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-1462"},"summary":{"title":"CVE-2009-1462","description":"The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-04-28 16:30:03","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325","name":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"razorCMS Support • View topic - Vulnerabilities found in v0.3 RC3","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://marc.info/?l=full-disclosure&m=123998062108561&w=2","name":"http://marc.info/?l=full-disclosure&m=123998062108561&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"'[Full-disclosure] [follow-up] razorCMS - Multiple Vulnerabilities' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50358","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50358","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/34566","name":"http://www.securityfocus.com/bid/34566","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"razorCMS 0.3RC2 Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://marc.info/?l=full-disclosure&m=123990481506680&w=2","name":"http://marc.info/?l=full-disclosure&m=123990481506680&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"'[Full-disclosure] razorCMS - Multiple Vulnerabilities' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1462","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1462","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"1462","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"razorcms","cpe5":"razorcms","cpe6":"0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1462","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"razorcms","cpe5":"razorcms","cpe6":"0.3","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1462","vulnerable":"1","versionEndIncluding":"0.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"razorcms","cpe5":"razorcms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:13:25.890Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325"},{"name":"20090416 [follow-up] razorCMS - Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://marc.info/?l=full-disclosure&m=123998062108561&w=2"},{"name":"20090416 razorCMS - Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://marc.info/?l=full-disclosure&m=123990481506680&w=2"},{"name":"34566","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/34566"},{"name":"razorcms-security-manager-unspecified(50358)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50358"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-04-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325"},{"name":"20090416 [follow-up] razorCMS - Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://marc.info/?l=full-disclosure&m=123998062108561&w=2"},{"name":"20090416 razorCMS - Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://marc.info/?l=full-disclosure&m=123990481506680&w=2"},{"name":"34566","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/34566"},{"name":"razorcms-security-manager-unspecified(50358)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50358"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-1462","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325","refsource":"CONFIRM","url":"http://razorcms.co.uk/support/viewtopic.php?f=13&t=325"},{"name":"20090416 [follow-up] razorCMS - Multiple Vulnerabilities","refsource":"FULLDISC","url":"http://marc.info/?l=full-disclosure&m=123998062108561&w=2"},{"name":"20090416 razorCMS - Multiple Vulnerabilities","refsource":"FULLDISC","url":"http://marc.info/?l=full-disclosure&m=123990481506680&w=2"},{"name":"34566","refsource":"BID","url":"http://www.securityfocus.com/bid/34566"},{"name":"razorcms-security-manager-unspecified(50358)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50358"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-1462","datePublished":"2009-04-28T16:00:00.000Z","dateReserved":"2009-04-28T00:00:00.000Z","dateUpdated":"2024-08-07T05:13:25.890Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-04-28 16:30:03","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:razorcms:razorcms:*:*:*:*:*:*:*:*","versionEndIncluding":"0.3","matchCriteriaId":"52856284-CC33-4779-8A9D-A9A02FEA6654"},{"vulnerable":true,"criteria":"cpe:2.3:a:razorcms:razorcms:0.2:*:*:*:*:*:*:*","matchCriteriaId":"5D9EDF45-CA3B-44B8-A87E-99083223007C"},{"vulnerable":true,"criteria":"cpe:2.3:a:razorcms:razorcms:0.3:rc2:*:*:*:*:*:*","matchCriteriaId":"F5B19BB3-8D38-4D4A-928E-75A45A63D6E6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"1462","Ordinal":"1","Title":"CVE-2009-1462","CVE":"CVE-2009-1462","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"1462","Ordinal":"1","NoteData":"The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.","Type":"Description","Title":"CVE-2009-1462"},{"CveYear":"2009","CveId":"1462","Ordinal":"2","NoteData":"2009-04-28","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"1462","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}