CVE-2012-5519

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

2.13% chance of exploitation in the next 30 days, 81th percentile

Published

2012-11-20

Updated

2024-08-06

Proof-of-concept exploits (2)

• 0zvxr/CVE-2012-55199★ · 2022-06-30
• p1ckzi/CVE-2012-55199★ · 2022-06-30

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/post/multi/escalate/cups_root_file_read.rb

References

• CVE Record
• NVD entry

Related

• CVE-2009-2265
• CVE-2022-22965
• CVE-2017-9841
• CVE-2022-35513
• CVE-2012-5470
• CVE-2012-5525