Unscored severity · published Feb 24, 2012
CVE-2012-0998
Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a
–
CVSS
1.6%
EPSS
No
On KEV
Description
Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Lepton · Lepton-cms
through 1.1.3; 1.1.0; 1.1.1; 1.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0998
www.lepton-cms.org
http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt
Patch
http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php
Exploit
https://www.htbridge.ch/advisory/HTB23072
More from Lepton
–
CVE-2012-1000
Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVE-2012-0999
SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter
–
CVE-2011-3385
Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML…