CVE-2012-2420

Severity Score

1.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % (percent) character as its (1) last or (2) second-to-last character, in situations where a certain "post-URL data" buffer contains a 0x0000 character but a buffer overflow does not occur.

Los manejadores intu-help-qb (también conocido como Intuit Help System Async Pluggable Protocol) en HelpAsyncPluggableProtocol.dll en Intuit QuickBooks v2009 hasta v2012, cuando se utiliza Internet Explorer, podría permitir a atacantes remotos obtener información sensible a través de un URI con un % (tanto por ciento) como (1) último o (2) penúltimo carácter, en situaciones en que una cierto búfer "post-URL data" contiene un carácter 0x0000, pero no se produce desbordamiento.

*Credits: N/A

CVSS Scores

NISTv2 1.8

Attack Vector

Adjacent

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-04-25 CVE Reserved
2012-04-25 CVE Published
2024-05-14 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (4)

URL	Tag	Source
http://osvdb.org/80820	Vdb Entry
http://www.kb.cert.org/vuls/id/232979	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/74548	Vdb Entry

URL	Date	SRC
http://www.securityfocus.com/archive/1/522138	2024-08-06

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Intuit Search vendor "Intuit"	Quickbooks Search vendor "Intuit" for product "Quickbooks"	2009 Search vendor "Intuit" for product "Quickbooks" and version "2009"	-	Affected	in	Microsoft Search vendor "Microsoft"	Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"	*	-	Safe
Intuit Search vendor "Intuit"	Quickbooks Search vendor "Intuit" for product "Quickbooks"	2010 Search vendor "Intuit" for product "Quickbooks" and version "2010"	-	Affected	in	Microsoft Search vendor "Microsoft"	Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"	*	-	Safe
Intuit Search vendor "Intuit"	Quickbooks Search vendor "Intuit" for product "Quickbooks"	2011 Search vendor "Intuit" for product "Quickbooks" and version "2011"	-	Affected	in	Microsoft Search vendor "Microsoft"	Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"	*	-	Safe
Intuit Search vendor "Intuit"	Quickbooks Search vendor "Intuit" for product "Quickbooks"	2012 Search vendor "Intuit" for product "Quickbooks" and version "2012"	-	Affected	in	Microsoft Search vendor "Microsoft"	Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"	*	-	Safe