Unscored severity · published Dec 31, 2013
CVE-2012-0261
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the…
–
CVSS
73.9%
EPSS
No
On KEV
Description
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.
Exploitation
Is it being used?
Exploit prediction (EPSS)73.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Monitor · Op5
through 5.5.1; 5.3.5; 5.4.0; 5.4.2; 5.5.0 · source: NVD
SY
System-portal · Op5
through 1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0261
seclists.org
http://seclists.org/fulldisclosure/2012/Jan/62
Vendor Advisory
http://secunia.com/advisories/47417
www.ekelow.se
http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf
www.op5.com
http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/
www.osvdb.org
http://www.osvdb.org/78064
bugs.op5.com
https://bugs.op5.com/view.php?id=5094
More from Monitor
6.1
CVE-2021-40272
OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS)
–
CVE-2014-4907
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or…
–
CVE-2013-6141
Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of authorization
–
CVE-2012-0264
op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors
–
CVE-2012-0263
monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error…