Unscored severity · published Sep 5, 2012
CVE-2012-2067
Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP module is enabled, allows remote authenticated users or remote attackers to execute arbitrary PHP code via the text parameter to a text filter. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
Ckeditor · Ckeditor
6.x-1.0; 6.x-1.0; 6.x-1.1; 6.x-1.2; 6.x-1.3; 6.x-1.4; +13 more · source: NVD
FC
Fckeditor · Ckeditor
6.x-1.1; 6.x-1.1; 6.x-1.1; 6.x-1.2; 6.x-1.2-1; 6.x-1.3; +29 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2067
Patch
http://drupal.org/node/1482442
Patch
http://drupal.org/node/1482466
Patch
http://drupal.org/node/1482480
Patch
http://drupal.org/node/1482528
Vendor Advisory
http://secunia.com/advisories/48435
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/04/07/1
More from Ckeditor
9.8
CVE-2023-31541
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be…
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
7.5
CVE-2011-4972
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct…
6.5
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…
6.5
CVE-2021-26271
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the…