CVE-2012-2965

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-12 · updated 2026-06-16
Weakness: CWE-20

Description

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.

Affected products

Caucho Resin: through 4.0.28; 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+81)

References

http://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979
http://caucho.com/resin-4.0/changes/changes.xtp
http://en.securitylab.ru/lab/
http://en.securitylab.ru/lab/PT-2012-05
http://www.kb.cert.org/vuls/id/309979

Get alerted when CVE-2012-2965 or the next vulnerability affects your stack