CVE-2012-3513 munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
HighCVSS 9.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/munin(Debian:12) | < 2.0.6-1 | 2.0.6-1 |
| debian/munin(Debian:13) | < 2.0.6-1 | 2.0.6-1 |
| debian/munin(Debian:14) | < 2.0.6-1 | 2.0.6-1 |
| munin-monitoring munin | <= 2.0.5 | No fix listed |
| munin-monitoring munin | = 2.0-beta1 | No fix listed |
| munin-monitoring munin | = 2.0-beta2 | No fix listed |
| munin-monitoring munin | = 2.0-beta3 | No fix listed |
| munin-monitoring munin | = 2.0-beta4 | No fix listed |
| munin-monitoring munin | = 2.0-beta5 | No fix listed |
| munin-monitoring munin | = 2.0-beta6 | No fix listed |
| munin-monitoring munin | = 2.0-beta7 | No fix listed |
| munin-monitoring munin | = 2.0-rc1 | No fix listed |
| munin-monitoring munin | = 2.0-rc2 | No fix listed |
| munin-monitoring munin | = 2.0-rc3 | No fix listed |
| munin-monitoring munin | = 2.0-rc4 | No fix listed |
| munin-monitoring munin | = 2.0-rc5 | No fix listed |
| munin-monitoring munin | = 2.0-rc6 | No fix listed |
| munin-monitoring munin | = 2.0-rc7 | No fix listed |
| munin-monitoring munin | = 2.0.0 | No fix listed |
| munin-monitoring munin | = 2.0.1 | No fix listed |
| munin-monitoring munin | = 2.0.2 | No fix listed |
| munin-monitoring munin | = 2.0.3 | No fix listed |
| munin-monitoring munin | = 2.0.4 | No fix listed |
References
- Debian Security Tracker CVE-2012-3513 vendor-advisory
- bugs.debian.org
- www.munin-monitoring.org exploit vendor-advisory
- [oss-security] 20120820 Two munin issues, now with CVEs mailing-list
- USN-1622-1 vendor-advisory
- bugs.debian.org issue-tracking