CVE-2012-3366
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the...
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
Exploit likelihood
What each source reports
NVD Score used
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
- Record
CVE-2012-3366- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
- Record
CVE-2012-3366- Updated
- 2026-11-02
EUVDEUVD-2012-3340 No score
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
- Record
EUVD-2012-3340- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pg2p-q27f-4f79 No score
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the...
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
- Record
GHSA-pg2p-q27f-4f79- Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bcfg2Debian:6.0 |
before 1.0.1-3+squeeze2, plus listed versions 1.0.1-31.0.1-3+squeeze1 |
1.0.1-3+squeeze2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3366 is a high vulnerability (CVSS 9.0) in Anl Bcfg2, published June 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.82%, the 90th percentile. Fixed in bcfg2 1.0.1-3+squeeze2.
References
github.com/Bcfg2/bcfg2/commit/a524967e8d5c4c22e49cd619aed20c87a316c0be
debian.org/security/2012/dsa-2503
secunia.com/advisories/49690
permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539
securityfocus.com/bid/54217
exchange.xforce.ibmcloud.com/vulnerabilities/76616
nvd.nist.gov/vuln/detail/CVE-2012-3366