Every CVESearch/Get API key

CVE-2012-3512

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable...

7.2 HighFix available

CVE-2012-3512 is a high vulnerability (CVSS 7.2) in Munin-monitoring Munin, published November 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in munin 2.0.6-1.

What does this mean?
Severity
7.2 HighCVSS 2.0, NVD
Exploit chance
0.59%EPSS, 48th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.0.6-1munin +3 more

Description

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Exploit likelihood

0.59%Down 1.3 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
munin
Debian:12
before 2.0.6-1
2.0.6-1
munin
Debian:13
before 2.0.6-1
2.0.6-1
munin
Debian:14
before 2.0.6-1
2.0.6-1
munin
Debian:6.0
From an advisory covering 3 CVEs
before 1.4.5-3+deb6u1, plus listed versions
1.4.5-3
1.4.5-3+deb6u1

What each source reports

NVD Score used7.2

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
CVE-2012-3512
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
CVE-2012-3512
Updated
2026-11-02
EUVDEUVD-2012-3467No score

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
EUVD-2012-3467
Updated
2026-11-03
GitHub AdvisoriesGHSA-g93j-j4g4-hr9qNo score

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable...

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
GHSA-g93j-j4g4-hr9q
Updated
2026-11-02
OSVNo score

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
CVE-2012-3512
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3512No score

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

Record
DEBIAN-CVE-2012-3512
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open