Vulnerability record · CVE-2009-4830 · published 27 April 2010

CVE-2009-4830: Openx improper authentication vulnerability

Openx · Openx

Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files.

7.5 CVSS 2.0 High EPSS 2.3% · top 17.1% CWE-287 · Improper authentication

7.5CVSS 2.0 base score

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Openx Openx

References

Link	Tags
http://blog.openx.org/12/security-matters-2/	PatchVendor Advisory
http://forum.openx.org/index.php?showtopic=503454011	Patch
http://osvdb.org/61300
http://secunia.com/advisories/37914	Vendor Advisory
http://www.securityfocus.com/bid/37457
http://blog.openx.org/12/security-matters-2/	PatchVendor Advisory
http://forum.openx.org/index.php?showtopic=503454011	Patch
http://osvdb.org/61300
http://secunia.com/advisories/37914	Vendor Advisory
http://www.securityfocus.com/bid/37457

Track CVE-2009-4830 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-4211OpenX Ad Server backdoor in flowplayer library allows PHP code executionOpenX Ad Server 2.8.10 ships a backdoored flowplayer-3.1.1.min.js library that permits remote arbitrary PHP code execution. The flaw is a code inject…EPSS 71%analysed14 Feb 2020 7.5CVE-2013-7149Openx sql injection vulnerabilitySQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Sourc…EPSS 2.0%28 Dec 2013 7.5CVE-2012-4990Openx sql injection vulnerabilitySQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL co…EPSS 2.3%22 Oct 2012 7.5CVE-2008-6163Openx sql injection vulnerabilitySQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid paramete…EPSS 2.4%20 Feb 2009 7.5CVE-2009-0291Openx path traversal vulnerabilityDirectory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the M…EPSS 7.0%27 Jan 2009 6.8CVE-2013-7376Openx cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the auth…EPSS 1.3%14 May 2014 6.8CVE-2013-5954Revive-adserver revive adserver cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of adminis…EPSS 3.1%25 Apr 2014 6.0CVE-2009-4098Openx improper input validation vulnerabilityUnrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file up…EPSS 19%29 Nov 2009

Source: NIST National Vulnerability Database (record CVE-2009-4830), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.