What’s Vulnerable › Vulnerabilities

CVE-2009-4417

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-12-24 · updated 2026-06-16
• Weakness: CWE-264

Description

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."

Affected products

• Zend Framework: through 1.9.6; 0.1.3-preview, 0.1.4-preview, 0.1.5-preview, 0.2.0-preview, 0.6.0-preview, 0.7.0-preview (+54)

References

• http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/
• http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/
• http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/
• http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/

Get alerted when CVE-2009-4417 or the next vulnerability affects your stack