CVE-2012-4821 Code injection in n/a
Remote attackers can execute arbitrary code via insecure reflection API usage in the IBM Java Runtime Environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4821?
CVE-2012-4821 is a critical code injection vulnerability in Ibm Lotus Domino, published on 11 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.
Which versions are affected by CVE-2012-4821?
It affects 16 products.
Products include Ibm Java, Ibm Lotus Domino, Ibm Lotus Notes, Ibm Lotus Notes Sametime, Ibm Lotus Notes Traveler, Ibm Rational Change and 10 more.
How do I fix CVE-2012-4821?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2012-4821 being exploited?
There is no known exploitation of CVE-2012-4821 in the wild and no public exploit code.
Other vulnerabilities in Ibm Lotus Domino
Sources
Also known as GHSA-m96x-9xwr-7g88.