CVE-2009-5142: Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.

Routine

MEDIUM 4.3UPGRADEDOWNGRADE

CVE-2009-5142 is a medium-severity flaw (CVSS 4.3) affecting timthumb, mimbo pro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	4.3 (Medium)
EPSS exploit chance	1.2% (top 31%)
CISA exploited list	No
Weakness	CWE-79
Published	2014-08-21
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: binarymoon · prothemedesign

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-08-21 23:55 UTCPublished CVE record published
2026-06-16 23:15 UTCUpdated Record last modified

binarymoon timthumb UPGRADE

Affected: <= 1.09

Fixed in: newer than 1.09

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy timthumb || rpm -q timthumb || timthumb --version

2. UPGRADE to newer than 1.09 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade timthumb

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade timthumb

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

prothemedesign mimbo pro DOWNGRADE

Affected: 2.3.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.3.1

1. Check installed version

apt-cache policy mimbo-pro || rpm -q mimbo-pro || mimbo-pro --version

2. No fixed release: DOWNGRADE to a release before 2.3.1 (Debian / Ubuntu)

apt-cache madison mimbo-pro sudo apt install mimbo-pro=<VERSION_BEFORE_2.3.1> sudo apt-mark hold mimbo-pro

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mimbo-pro sudo dnf downgrade mimbo-pro-<VERSION_BEFORE_2.3.1> sudo dnf versionlock add mimbo-pro

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2009-5142?

timthumb: upgrade to newer than 1.09; mimbo pro: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2009-5142 being exploited?

CVE-2009-5142 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2009-5142 affect?

CVE-2009-5142 affects timthumb, mimbo pro. Severity is medium (CVSS 4.3). Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

How urgent is CVE-2009-5142?

Priority 37/100. Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2014-4663 MEDIUM 6.8 DOWNGRADE DOWNGRADE TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute
CVE-2011-4106 MEDIUM 6.8 UPGRADE TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allow
CVE-2010-5303 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15
CVE-2010-5302 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used

References

← Back to latest CVEs