CVE-2012-2244 Command injection in n/a
Authenticated administrators can execute arbitrary programs by modifying the ClamAV path, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2244?
CVE-2012-2244 is a medium-severity command injection vulnerability in Mahara Mahara, published on 24 Nov 2012. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav. NOTE: this can be exploited without authentication by leveraging CVE-2012-2243.
Weakness: CWE-264
Which versions are affected by CVE-2012-2244?
It affects 1 product.
Products include Mahara Mahara.
How do I fix CVE-2012-2244?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2012-2244 being exploited?
There is no known exploitation of CVE-2012-2244 in the wild and no public exploit code.
Other vulnerabilities in Mahara Mahara
Sources
Also known as GHSA-5gwj-6v75-5r3m.