PT-2014-2270 · Nigel Mcnie · Geshi

Benbe + 1 · Published 2014-06-13 · Updated 2022-05-17 · CVE-2012-3521

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GeSHi versions prior to 1.0.8.11

Description The issue concerns multiple directory traversal vulnerabilities in the cssgen contrib module. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. (dot dot) in the geshi-path or geshi-lang-path parameter.

Recommendations For versions prior to 1.0.8.11, update to version 1.0.8.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the cssgen contrib module until the update is applied. Avoid using the geshi-path and geshi-lang-path parameters in a way that could facilitate directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-3521

GHSA-FW3X-2PR2-5J64

Affected Products

Geshi

References · 16

• 🔥 http://sourceforge.net/p/geshi/code/2507 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2012-3521 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3521 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3521 · Security Note
• https://ubuntu.com/security/CVE-2012-3521 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105317.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3521 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105273.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3521 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fw3x-2pr2-5j64 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3521 · Vendor Advisory
• https://github.com/GeSHi/geshi-1.0 · Note
• http://seclists.org/oss-sec/2012/q3/265 · Note
• http://openwall.com/lists/oss-security/2012/08/21/11 · Note