{"id":"CVE-2012-3366","aliases":["DEBIAN-CVE-2012-3366","DSA-2503-1","EUVD-2012-3340","GHSA-pg2p-q27f-4f79"],"status":"published","title":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the...","description":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).","severity":{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03777,"percentile":0.90019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2012-06-28T00:00:00Z","modified":"2026-06-16T23:43:05Z","fixes":[{"ecosystem":"Debian:6.0","package":"bcfg2","fixed_in":["1.0.1-3+squeeze2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"bcfg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-3+squeeze2"}]}],"versions":["1.0.1-3","1.0.1-3+squeeze1"]}],"products":[{"vendor":"anl","product":"bcfg2"}],"references":[{"url":"https://github.com/Bcfg2/bcfg2/commit/a524967e8d5c4c22e49cd619aed20c87a316c0be","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.debian.org/security/2012/dsa-2503","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/49690","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/54217","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/49629","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/76616","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3366"},{"url":"https://github.com/advisories/GHSA-pg2p-q27f-4f79"}],"sources":{"cve":[{"id":"CVE-2012-3366","description":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).","status":"published","published":"2012-07-03T16:00:00Z","modified":"2024-08-06T20:05:12.537Z","updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3340","description":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).","status":"published","published":"2012-07-03T16:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:11.327216Z"}],"ghsa":[{"id":"GHSA-pg2p-q27f-4f79","title":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the...","description":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).","status":"published","published":"2022-05-17T01:44:03Z","modified":"2023-02-03T05:05:20Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:53:43.432623Z"}],"nvd":[{"id":"CVE-2012-3366","description":"The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).","status":"published","published":"2012-07-03T16:40:35.007Z","modified":"2026-06-16T23:43:05.1Z","cvss":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"DSA-2503-1","title":"bcfg2 - shell command injection","status":"published","published":"2012-06-28T00:00:00Z","modified":"2026-03-09T01:23:33.557022Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}