CVE-2012-4820 Privilege escalation in n/a
Remote attackers can escalate privileges by bypassing the Java security manager via insecure reflection usage in IBM JRE.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4820?
CVE-2012-4820 is a critical vulnerability in Ibm Lotus Domino, published on 11 Jan 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
Which versions are affected by CVE-2012-4820?
It affects 16 products.
Products include Ibm Java, Ibm Lotus Domino, Ibm Lotus Notes, Ibm Lotus Notes Sametime, Ibm Lotus Notes Traveler, Ibm Rational Change and 10 more.
How do I fix CVE-2012-4820?
Upgrade to a fixed version.
Is CVE-2012-4820 being exploited?
There is no known exploitation of CVE-2012-4820 in the wild and no public exploit code.
Other vulnerabilities in Ibm Lotus Domino
Sources
Also known as GHSA-jfrg-75v5-493f.