CVE-2009-4405 json
Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils
published 16y ago modified 4mo ago also GHSA-f9qv-j5g6-g5cr , PYSEC-2009-7 , EUVD-2009-0010
- cvss
- 7.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
Patch / fix
Is CVE-2009-4405 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | trac | <0.11.6 |
0.11.6 |
References
-
redhat.com
/archives/fedora-package-announce/2009-December/msg01169.html
vendor-advisory, web
-
vupen.com
/english/advisories/2009/3615
vdb-entry, vendor-advisory, advisory
-
secunia.com
/advisories/37807
third-party-advisory, vendor-advisory, advisory
-
secunia.com
/advisories/37901
third-party-advisory, vendor-advisory, advisory
-
trac.edgewall.org
/browser/tags/trac-0.11.6/RELEASE
web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/54983
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=542394
web, report
-
nvd.nist.gov
/vuln/detail/CVE-2009-4405
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2009-7.yaml
web
-
web.archive.org
/web/20130417170303/http://secunia.com/advisories/37901
web
-
web.archive.org
/web/20130513235205/http://secunia.com/advisories/37807
web
-
github.com
/advisories/GHSA-f9qv-j5g6-g5cr
advisory
Sources
- CVE List CVE-2009-4405
- GitHub Advisory GHSA-f9qv-j5g6-g5cr
- NVD CVE-2009-4405
- OSV PYSEC-2009-7
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.