CVE-2012-2421

Severity: low (CVSS 1.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-04-25 · updated 2026-06-16
Weakness: CWE-22

Description

Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a full pathname in the URI.

Affected products

Intuit Quickbooks: 2009, 2010, 2011, 2012

References

http://www.kb.cert.org/vuls/id/232979
http://www.securityfocus.com/archive/1/522139
https://exchange.xforce.ibmcloud.com/vulnerabilities/75172
http://www.kb.cert.org/vuls/id/232979
http://www.securityfocus.com/archive/1/522139
https://exchange.xforce.ibmcloud.com/vulnerabilities/75172

Get alerted when CVE-2012-2421 or the next vulnerability affects your stack