Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-2174

CWE-94 — Code Injection4 documents4 sources
Severity
9.3CRITICAL
EPSS
64.6%
top 1.54%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
IBM Lotus Notes
Timeline
PublishedJun 20
Latest updateMay 17

Description

The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDibm/lotus_notes27 versions+26

🔴Vulnerability Details

2
GHSA
GHSA-74f9-jmf7-mh4c: The URL handler in IBM Lotus Notes 8↗2022-05-17
▶
CVEList
CVE-2012-2174: The URL handler in IBM Lotus Notes 8↗2012-06-20
▶

💥Exploits & PoCs

1
Exploit-DB
IBM Lotus Notes Client URL Handler - Command Injection (Metasploit)↗2012-12-25
▶