CVE-2012-3454
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
eXtplorer是一套基于PHP的在线文件管理程序，它支持在线浏览文件和文件夹以及作为FTP客户端登录FTP服务器。 Debian extplorer中的/var/lib/extplorer/ftp_tmp目录中存在不安全文件权限漏洞。本地攻击者可利用该漏洞删除并替换任意数据文件，且有助于进一步攻击。extplorer 2.1.0b6版本中存在漏洞，其他版本也可能受到影响。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2012-3454
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory, which allows local users to delete or overwrite arbitrary files.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Debian ‘extplorer’数据包不安全文件权限漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
eXtplorer是一套基于PHP的在线文件管理程序，它支持在线浏览文件和文件夹以及作为FTP客户端登录FTP服务器。 Debian extplorer中的/var/lib/extplorer/ftp_tmp目录中存在不安全文件权限漏洞。本地攻击者可利用该漏洞删除并替换任意数据文件，且有助于进一步攻击。extplorer 2.1.0b6版本中存在漏洞，其他版本也可能受到影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2012-3454
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2012-3454
请登录查看更多情报信息。
Vendor Advisories for CVE-2012-3454 (1)
Mailing List Discussions for CVE-2012-3454 (1)
Same Patch Batch · n/a · 2012-08-07 · 20 CVEs total
| CVE-2012-2652 | Qemu 不安全临时文件漏洞 | |
| CVE-2012-4005 | Naver Cloud Explorer敏感信息漏洞 | |
| CVE-2012-2648 | Apple iPad/iPhone/iPod touch iOS 跨站脚本漏洞 | |
| CVE-2012-2317 | PHP 认证绕过漏洞 | |
| CVE-2012-2022 | HP NNMi 多个跨站脚本漏洞 | |
| CVE-2012-4177 | Ubisoft Uplay PC 任意程序执行漏洞 | |
| CVE-2012-3453 | Debian ‘logol’数据包不安全文件权限漏洞 | |
| CVE-2012-3452 | Gnome-screensaver 安全绕过漏洞 | |
| CVE-2012-3449 | Open vSwitch 任意文件重新漏洞 | |
| CVE-2012-3413 | KDE PIM 安全限制绕过漏洞 | |
| CVE-2012-4178 | Symantec Web Gateway‘deptUploads_data.php’SQL注入漏洞 | |
| CVE-2012-3445 | Libvirt 远程拒绝服务漏洞 | |
| CVE-2012-3438 | GraphicsMagick PNG图像解析拒绝服务漏洞 | |
| CVE-2012-3437 | ImageMagick PNG图像解析拒绝服务漏洞 | |
| CVE-2012-3429 | Bind-dyndb-ldap 远程拒绝服务漏洞 | |
| CVE-2012-3423 | IcedTea-Web 任意代码执行漏洞 | |
| CVE-2012-3422 | IcedTea-Web ‘getFirstInTableInstance()’函数任意代码执行漏洞 | |
| CVE-2012-3386 | GNU Automake 竞争条件问题漏洞 | |
| CVE-2012-0213 | Apache POI 拒绝服务漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
V. Comments for CVE-2012-3454
No comments yet