PT-2014-2270 · Nigel Mcnie · Geshi

Benbe + 1 · Publicado 2014-06-13 · Atualizado 2022-05-17 · CVE-2012-3521

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GeSHi versions prior to 1.0.8.11

Description The issue concerns multiple directory traversal vulnerabilities in the cssgen contrib module. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. (dot dot) in the geshi-path or geshi-lang-path parameter.

Recommendations For versions prior to 1.0.8.11, update to version 1.0.8.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the cssgen contrib module until the update is applied. Avoid using the geshi-path and geshi-lang-path parameters in a way that could facilitate directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-3521

GHSA-FW3X-2PR2-5J64

Produtos afetados

Geshi

Referências · 16

• 🔥 http://sourceforge.net/p/geshi/code/2507 · Exploit
• https://github.com/GeSHi/geshi-1.0 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-3521 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3521 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2012-3521 · Nota de Segurança
• https://ubuntu.com/security/CVE-2012-3521 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105317.html · Aviso do Fabricante
• http://seclists.org/oss-sec/2012/q3/265 · Nota
• http://openwall.com/lists/oss-security/2012/08/21/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3521 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105273.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3521 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fw3x-2pr2-5j64 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3521 · Aviso do Fabricante