Read the docs
TI-2009-04180 Aliases CVE-2009-4417GHSA-m29x-48p8-pr8r

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows…

Priority LOW 24CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."

Why it matters now

EPSS 0.0086 58th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 61

CPEVersionsRoleVendor
cpe:2.3:a:zend:framework:*:*:*:*:*:*:*:*up to 1.9.6VulnerableZend
cpe:2.3:a:zend:framework:0.1.3:preview:*:*:*:*:*:*0.1.3 previewVulnerableZend
cpe:2.3:a:zend:framework:0.1.4:preview:*:*:*:*:*:*0.1.4 previewVulnerableZend
cpe:2.3:a:zend:framework:0.1.5:preview:*:*:*:*:*:*0.1.5 previewVulnerableZend
cpe:2.3:a:zend:framework:0.2.0:preview:*:*:*:*:*:*0.2.0 previewVulnerableZend
cpe:2.3:a:zend:framework:0.6.0:preview:*:*:*:*:*:*0.6.0 previewVulnerableZend
cpe:2.3:a:zend:framework:0.7.0:preview:*:*:*:*:*:*0.7.0 previewVulnerableZend
cpe:2.3:a:zend:framework:0.8.0:preview:*:*:*:*:*:*0.8.0 previewVulnerableZend
cpe:2.3:a:zend:framework:0.9.0:beta:*:*:*:*:*:*0.9.0 betaVulnerableZend
cpe:2.3:a:zend:framework:0.9.1:beta:*:*:*:*:*:*0.9.1 betaVulnerableZend
  • cpe:2.3:a:zend:framework:*:*:*:*:*:*:*:* Versions up to 1.9.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.1.3:preview:*:*:*:*:*:* Versions 0.1.3 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.1.4:preview:*:*:*:*:*:* Versions 0.1.4 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.1.5:preview:*:*:*:*:*:* Versions 0.1.5 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.2.0:preview:*:*:*:*:*:* Versions 0.2.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.6.0:preview:*:*:*:*:*:* Versions 0.6.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.7.0:preview:*:*:*:*:*:* Versions 0.7.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.8.0:preview:*:*:*:*:*:* Versions 0.8.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.9.0:beta:*:*:*:*:*:* Versions 0.9.0 beta Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.9.1:beta:*:*:*:*:*:* Versions 0.9.1 beta Vulnerable ·Zend
Show 51 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zend:framework:0.9.2:beta:*:*:*:*:*:*0.9.2 betaVulnerableZend
cpe:2.3:a:zend:framework:0.9.3:beta:*:*:*:*:*:*0.9.3 betaVulnerableZend
cpe:2.3:a:zend:framework:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableZend
cpe:2.3:a:zend:framework:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1VulnerableZend
cpe:2.3:a:zend:framework:1.0.0:rc2:*:*:*:*:*:*1.0.0 rc2VulnerableZend
cpe:2.3:a:zend:framework:1.0.0:rc3:*:*:*:*:*:*1.0.0 rc3VulnerableZend
cpe:2.3:a:zend:framework:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableZend
cpe:2.3:a:zend:framework:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableZend
cpe:2.3:a:zend:framework:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableZend
cpe:2.3:a:zend:framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableZend
cpe:2.3:a:zend:framework:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableZend
cpe:2.3:a:zend:framework:1.5.0:preview:*:*:*:*:*:*1.5.0 previewVulnerableZend
cpe:2.3:a:zend:framework:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1VulnerableZend
cpe:2.3:a:zend:framework:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2VulnerableZend
cpe:2.3:a:zend:framework:1.5.0:rc3:*:*:*:*:*:*1.5.0 rc3VulnerableZend
cpe:2.3:a:zend:framework:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableZend
cpe:2.3:a:zend:framework:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableZend
cpe:2.3:a:zend:framework:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableZend
cpe:2.3:a:zend:framework:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableZend
cpe:2.3:a:zend:framework:1.6.0:rc1:*:*:*:*:*:*1.6.0 rc1VulnerableZend
cpe:2.3:a:zend:framework:1.6.0:rc2:*:*:*:*:*:*1.6.0 rc2VulnerableZend
cpe:2.3:a:zend:framework:1.6.0:rc3:*:*:*:*:*:*1.6.0 rc3VulnerableZend
cpe:2.3:a:zend:framework:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZend
cpe:2.3:a:zend:framework:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZend
cpe:2.3:a:zend:framework:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableZend
cpe:2.3:a:zend:framework:1.7.0:preview:*:*:*:*:*:*1.7.0 previewVulnerableZend
cpe:2.3:a:zend:framework:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZend
cpe:2.3:a:zend:framework:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZend
cpe:2.3:a:zend:framework:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZend
cpe:2.3:a:zend:framework:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZend
cpe:2.3:a:zend:framework:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableZend
cpe:2.3:a:zend:framework:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableZend
cpe:2.3:a:zend:framework:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableZend
cpe:2.3:a:zend:framework:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableZend
cpe:2.3:a:zend:framework:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableZend
cpe:2.3:a:zend:framework:1.8.0:alpha_1:*:*:*:*:*:*1.8.0 alpha_1VulnerableZend
cpe:2.3:a:zend:framework:1.8.0:beta_1:*:*:*:*:*:*1.8.0 beta_1VulnerableZend
cpe:2.3:a:zend:framework:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZend
cpe:2.3:a:zend:framework:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZend
cpe:2.3:a:zend:framework:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableZend
cpe:2.3:a:zend:framework:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableZend
cpe:2.3:a:zend:framework:1.9:*:*:*:*:*:*:*1.9VulnerableZend
cpe:2.3:a:zend:framework:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableZend
cpe:2.3:a:zend:framework:1.9.0:alpha_1:*:*:*:*:*:*1.9.0 alpha_1VulnerableZend
cpe:2.3:a:zend:framework:1.9.0:beta_1:*:*:*:*:*:*1.9.0 beta_1VulnerableZend
cpe:2.3:a:zend:framework:1.9.0:rc1:*:*:*:*:*:*1.9.0 rc1VulnerableZend
cpe:2.3:a:zend:framework:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableZend
cpe:2.3:a:zend:framework:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableZend
cpe:2.3:a:zend:framework:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableZend
cpe:2.3:a:zend:framework:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableZend
cpe:2.3:a:zend:framework:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableZend
  • cpe:2.3:a:zend:framework:0.9.2:beta:*:*:*:*:*:* Versions 0.9.2 beta Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:0.9.3:beta:*:*:*:*:*:* Versions 0.9.3 beta Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.0:preview:*:*:*:*:*:* Versions 1.5.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.0:rc3:*:*:*:*:*:* Versions 1.5.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.0:rc1:*:*:*:*:*:* Versions 1.6.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.0:rc2:*:*:*:*:*:* Versions 1.6.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.0:rc3:*:*:*:*:*:* Versions 1.6.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.0:preview:*:*:*:*:*:* Versions 1.7.0 preview Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.0:alpha_1:*:*:*:*:*:* Versions 1.8.0 alpha_1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.0:beta_1:*:*:*:*:*:* Versions 1.8.0 beta_1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.0:alpha_1:*:*:*:*:*:* Versions 1.9.0 alpha_1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.0:beta_1:*:*:*:*:*:* Versions 1.9.0 beta_1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.0:rc1:*:*:*:*:*:* Versions 1.9.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:framework:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Zend

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4417
  2. 2026-10-03 Alias added: GHSA-m29x-48p8-pr8r

References

Exploit 2

  • TI-2015-00237 Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. CVSS 3.1CRITICAL 9.8
  • TI-2011-03382 Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences