FKIE_CVE-2012-2969
Vulnerability from fkie_nvd - Published: 2012-08-12 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:caucho:resin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB62BA5C-7827-40AA-9D83-E4AEA482395B",
"versionEndIncluding": "4.0.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4A9A59D-6C5A-4917-857E-D183B6982EFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "457E68AD-E7F1-4845-9CBE-0FA4D8A8D946",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A334508B-849A-45D3-B83D-E0AE5AB4A601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "60930A08-2692-4809-89B7-3B2FB5CEF7C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "85003E89-F293-4846-AA6C-047FD3178333",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C34209E9-E33F-49C7-A298-61EEBAE77C9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BD3720FA-6136-48D0-82B8-513EFC26D4A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08F7C559-7B3D-44E2-8A22-58FA021E3EC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B47B8CB3-C2ED-4E37-84DE-8018114CFE6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54379312-A5E3-41DA-A50C-554C8787FDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3AF6E9A6-5F37-4443-8D64-9C173DABDCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9759471-88B7-43D8-81AA-DFC74AE49563",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "70210B6F-B3E1-41F7-883C-4A449A480B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CE141992-980B-4021-80B1-694DB3F21D88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2079B923-2976-46BB-A28F-674EAFCCA426",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "21AEF4E3-E4AE-4053-A332-D8773F7BEC38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "EACB10DA-9825-4D86-AD90-07CE961915A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9F12E529-14C8-4251-855D-88E3DC3BD71B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "DD14F784-48E0-4F84-8F81-6AEC1A112249",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEF7D28-7E47-458D-9366-A916032F0594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8E0C1155-4E40-4597-96CF-F6BCDF2C979F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.15:*:*:*:*:*:*:*",
"matchCriteriaId": "E0651EE5-BFB1-41C7-B1F4-D61A19D98EBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.16:*:*:*:*:*:*:*",
"matchCriteriaId": "31C49426-91D0-4505-88FD-19E216333C85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:2.1.snap:*:*:*:*:*:*:*",
"matchCriteriaId": "ED74BDDE-5978-4F48-A460-D0A7BD54154C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B781357-4F5F-45E9-B2AC-8C91C7BBD759",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "D18C7FAC-3AC3-461A-B94E-4C4E516F79EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "D6E82173-38B3-44F7-9B21-BD176AD401AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C709DB7B-64BC-4CAC-9900-86B4B8C65D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B19E7FA9-48A2-452E-9A88-6DDCFA5F04EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1C6D56BA-0115-4F94-900F-C7246CBAFB5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A6766F1-DAEF-4B46-A437-70A0DA796CB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0C87B844-CB4F-432C-BB95-0BFFE21F70FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AE0B374-65DC-41A1-BD26-484BEDCC208D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "318C85EA-0F00-4306-887F-9A2111C45736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C3348884-8D55-4A51-BB9B-94339A20F706",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4A98DE-00B4-4211-A4D1-D88DA34E3832",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04D7A448-ECCA-48D8-BBF1-ABBF2F1FD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "34C6864E-414B-464E-BC17-36B554A5EE92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBB81A1-3CDD-4890-B19B-C4E4DFC7FC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AB00A312-45F7-4C66-AAF5-C952DB8FFEAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "75B7A1C6-AF66-4CF2-A2D9-3D9E0F1B78B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "1E4E9AF1-F863-4319-BB96-9E6CAA8FAB92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "976D2F97-5EA3-45EC-91C2-33B8081F7260",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "D43ABA6E-5061-498C-A68C-44C6942DD96E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "6CB83B0F-A221-4CDA-83FC-CC8FE740AE7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "ED9ACA71-58A4-4506-83E6-36E8C09DF1E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "859A606A-3327-4884-B7F4-769B32400D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "93A3F13E-272A-4FDA-AA54-BD75BE78C393",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4BE4593-C422-46D1-8F4E-293C508B5D83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3791E1F7-8776-48DE-B918-18DB08D6F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9F397825-AA09-4F34-821C-B567B04FCB23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4F18F7E1-DB6D-4FA8-81C2-05EC23DE46D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88CD809F-AFC5-40CD-B709-E797174FA5CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF07CD8-6479-464E-A3CB-0F680C34461C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0146DE06-1B29-4344-A6A6-34D627E407F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D56CE194-BC17-40B7-8775-DD267731B9D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "B9EF1405-8B4E-4314-8A9D-19B3CAF15229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5FD16B09-AC60-4296-A523-94F960985A24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:3.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "1152C994-7446-43F8-90D7-4298F81C5454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "32D0F9D9-84D7-4F04-8432-9560BBC8B529",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E04F2867-324D-451D-ABB9-A74678110777",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "89500B66-3459-46E9-A0EC-D32AF212EAD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80B7FCA8-6C17-4C5B-98A0-C44B5338D84B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "801FA247-802F-4387-9A56-50ACE7440599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1E02F8DF-0680-47DD-9773-80CA8BBA9947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "82BCE2FC-EE12-4B58-8B26-1EBAD3614A94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "89008076-FA94-430E-9AD5-8F53D5114421",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4BA9823D-9330-4E05-803B-C336B43FB0C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "512714F0-E392-472F-A520-D3EF690BB2CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5ACB49A3-9A0B-4C4C-949B-B569C2049B0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3EBF56AD-F93B-4370-A850-7046DE36591A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "DAFD4305-8A81-4C31-B97A-06F063A16827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BB7697BE-FF95-46DF-9DD1-5D114B0151BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "3D3ABF12-D4C0-4D0A-8FBD-13F596B5CDFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6BE8DB-6CCF-48CC-8992-546BBEE56050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7A9E8929-07DE-4525-95C3-24C63FB77AE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "CF191346-0D21-4773-B0BF-2FBAEC78731C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "76C26F87-0FD8-4252-8EE6-2D34FC42D441",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "41325FF5-F3FC-4F2E-8EA6-41EEAA8AC724",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "70990ADF-5ABE-4C69-8ECA-F725119F0C11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "6CAA2934-AA3A-4AD3-ACCD-96B66BAC1C73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.22:*:*:*:*:*:*:*",
"matchCriteriaId": "39C70610-2570-4DE1-9FAC-971C5234208E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.23:*:*:*:*:*:*:*",
"matchCriteriaId": "6A70AAE6-EB10-4544-BFD1-6679D86D8FC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.24:*:*:*:*:*:*:*",
"matchCriteriaId": "0813C483-FDFD-4CA0-AEB5-110959D27DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.25:*:*:*:*:*:*:*",
"matchCriteriaId": "82A5CBB1-F008-473F-973D-C77FF7ACE18D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.26:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1F3562-660A-46D8-AF58-F30E37C71C33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:caucho:resin:4.0.27:*:*:*:*:*:*:*",
"matchCriteriaId": "14DA8A16-B6DB-443C-8A6E-8055DA2AA38F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request."
},
{
"lang": "es",
"value": "Caucho Quercus, tal y como se distribuye en Resin antes de v4.0.29, permite a atacantes remotos eludir las restricciones previstas en las extensiones de archivos para archivos creados con una secuencia 00% en la ruta de acceso dentro de una petici\u00f3n HTTP.\r\n"
}
],
"id": "CVE-2012-2969",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-12T16:55:01.293",
"references": [
{
"source": "cret@cert.org",
"url": "http://caucho.com/resin-4.0/changes/changes.xtp"
},
{
"source": "cret@cert.org",
"url": "http://en.securitylab.ru/lab/"
},
{
"source": "cret@cert.org",
"url": "http://en.securitylab.ru/lab/PT-2012-05"
},
{
"source": "cret@cert.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/309979"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://caucho.com/resin-4.0/changes/changes.xtp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://en.securitylab.ru/lab/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://en.securitylab.ru/lab/PT-2012-05"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/309979"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…