Strix
26.1K

CVE-2009-0919

UnknownEPSS 6.81%

Last modified

CVE-2009-0919 is a vulnerability of currently unknown severity. XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. EPSS estimates a 6.81% chance of exploitation in the next 30 days.

Description

XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."

Metrics

EPSS Probability
6.81%

93.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ApachefriendsXampp0.1Alpha
ApachefriendsXampp0.2Alpha
ApachefriendsXampp0.3—
ApachefriendsXampp0.4—
ApachefriendsXampp0.5—
ApachefriendsXampp0.6—
ApachefriendsXampp0.6.1—
ApachefriendsXampp0.6.2—
ApachefriendsXampp0.6.3—
ApachefriendsXampp0.6a—
ApachefriendsXampp0.7Beta
ApachefriendsXampp0.7.0—
ApachefriendsXampp0.7.1—
ApachefriendsXampp0.7.2—
ApachefriendsXampp0.7.3—
ApachefriendsXampp0.7.4—
ApachefriendsXampp0.8.1—
ApachefriendsXampp0.8.2—
ApachefriendsXampp0.9—
ApachefriendsXampp1.0—
ApachefriendsXampp1.0.1—
ApachefriendsXampp1.1—
ApachefriendsXampp1.2—
ApachefriendsXampp1.3—
ApachefriendsXampp1.4—
ApachefriendsXampp1.4.2—
ApachefriendsXampp1.4.3—
ApachefriendsXampp1.4.4—
ApachefriendsXampp1.4.5—
ApachefriendsXampp1.4.6—
ApachefriendsXampp1.4.7—
ApachefriendsXampp1.4.8—
ApachefriendsXampp1.4.9—
ApachefriendsXampp1.4.10—
ApachefriendsXampp1.4.11—
ApachefriendsXampp1.4.12—
ApachefriendsXampp1.4.13—
ApachefriendsXampp1.4.14—
ApachefriendsXampp1.4.15—
ApachefriendsXampp1.4.16—
ApachefriendsXampp1.5—
ApachefriendsXampp1.5.0—
ApachefriendsXampp1.5.1—
ApachefriendsXampp1.5.2—
ApachefriendsXampp1.5.3—
ApachefriendsXampp1.5.4—
ApachefriendsXampp1.5.4a—
ApachefriendsXampp1.5.5—
ApachefriendsXampp1.5.5a—
ApachefriendsXampp1.6—

Showing 50 of 68 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-0919?
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."
How severe is CVE-2009-0919?
Severity scoring for CVE-2009-0919 is pending analysis. The EPSS model estimates a 6.81% probability of exploitation in the next 30 days.
How do I fix CVE-2009-0919?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-0919?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST