CVE-2012-0315

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-22 · updated 2026-06-16

Description

Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file.

Affected products

ESTsoft Alftp: through 5.1; 4.1, 4.1-beta2, 5.0, 5.1-beta2

References

http://jvn.jp/en/jp/JVN85695061/995223/index.html
http://jvn.jp/en/jp/JVN85695061/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000011
http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118
http://www.altools.jp/download.aspx
http://jvn.jp/en/jp/JVN85695061/995223/index.html
http://jvn.jp/en/jp/JVN85695061/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000011
http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118
http://www.altools.jp/download.aspx

Get alerted when CVE-2012-0315 or the next vulnerability affects your stack