high7.5
CVE-2012-2966
Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters
Impact
Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.caucho:resin | < 4.0.29 | 4.0.29 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Caucho | Resin | through 4.0.28 Versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4 |
References
- NVD record
- CVE.org record
- GitHub advisory
- http://caucho.com/resin-4.0/changes/changes.xtp
- http://en.securitylab.ru/lab/
- http://en.securitylab.ru/lab/PT-2012-05
- http://www.kb.cert.org/vuls/id/309979
- https://github.com/advisories/GHSA-g5fx-ccwv-5c4f
- https://nvd.nist.gov/vuln/detail/CVE-2012-2966
- http://en.securitylab.ru/lab
- https://web.archive.org/web/20131210160901/http://en.securitylab.ru:80/lab/PT-2012-05