CVE-2012-2421 json
Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableP…
published 2012-04-25 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-2407
- cvss
- 1.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a full pathname in the URI.
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 1.8 | AV:A/AC:H/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/75172
vdb-entry
-
securityfocus.com
/archive/1/522139
mailing-list
-
kb.cert.org
/vuls/id/232979
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2012-2421
- NVD CVE-2012-2421
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.