CVE-2009-3304
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink...
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
Exploit likelihood
What each source reports
NVD Score used
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
- Record
CVE-2009-3304- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
- Record
CVE-2009-3304- Updated
- 2026-11-02
EUVDEUVD-2009-3286 No score
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
- Record
EUVD-2009-3286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hq9-j8x9-925r No score
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink...
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
- Record
GHSA-3hq9-j8x9-925r- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gforgeDebian:4.0 |
before 4.5.14-22etch13, plus listed versions 4.5.14-224.5.14-22etch14.5.14-22etch104.5.14-22etch114.5.14-22etch12 Show 8 moreShow less4.5.14-22etch24.5.14-22etch34.5.14-22etch44.5.14-22etch54.5.14-22etch64.5.14-22etch74.5.14-22etch84.5.14-22etch9 |
4.5.14-22etch13 |
gforgeDebian:5.0 |
before 4.7~rc2-7lenny3, plus listed versions 4.7~rc2-74.7~rc2-7lenny14.7~rc2-7lenny2 |
4.7~rc2-7lenny3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3304 is a low vulnerability (CVSS 3.3) in Gforge, published December 3, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in gforge 4.5.14-22etch13.