What is the CVSS score of CVE-2012-1468?

CVE-2012-1468 has a CVSS 2.0 base score of 6.0 (Medium). CVSS vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. EPSS exploitation probability: 12.5%.

Is there a public PoC exploit available for CVE-2012-1468?

Yes, a public proof-of-concept exploit is available for CVE-2012-1468. Prioritise patching immediately. EPSS: 12.5%.

Open Journal Systems CVE-2012-1468

MEDIUM

2012-09-06 cve@mitre.org

PHP RCE Open Journal Systems Pkp

6.0

CVSS 2.0 · NVD

View

Vulnerability Assessment

Impact	CVSS score of 6.0 (MEDIUM). Attack characteristics: network attack vector, M complexity. Public proof-of-concept exploit code is available. EPSS exploitation probability: 12.47%.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 12.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 12.5%.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions. Affected products include: Pkp Open Journal Systems. Version information: before 2.3.7.

Know when Open Journal Systems gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.0 MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

DescriptionCVE.org

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.

Threat Intelligence Overview

EPSS Score

12.5%

Top 6% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 12.5%

Patch available No

Active threat Yes

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +12

CVSS: +30

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:pkp:open_journal_systems:*:*:*:*:*:*:*:*

More in Open Journal Systems

View all

CVE-2012-1469 MEDIUM This Month POC

4.3 Sep 06

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remo

CVE-2012-1467 MEDIUM This Month POC

6.5 Sep 06

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.

CVE-2024-25438 MEDIUM This Month POC

6.1 Mar 01

A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrar

CVE-2024-25436 MEDIUM This Month POC

6.1 Mar 01

A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrar

CVE-2024-24512 MEDIUM This Month POC

6.1 Mar 01

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle

CVE-2024-24511 MEDIUM This Month POC

6.1 Mar 01

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title com

CVE-2022-24181 MEDIUM This Month POC

6.1 Apr 01

Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to

CVE-2024-25434 MEDIUM This Month POC

5.4 Mar 01

A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via

CVE-2023-5894 MEDIUM This Month POC

5.4 Nov 01

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16. Rated medium severity (CVSS 5.4), th

CVE-2023-6671 HIGH This Week

8.8 Dec 11

A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an e

CVE-2024-7902 MEDIUM This Month

6.9 Aug 17

A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Rated medium severity (CVSS 6.9), this

CVE-2022-26616 MEDIUM This Month

6.1 Apr 04

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

REF http://pkp.sfu.ca/ojs/RELEASE-2.3.7 REF http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back