Strix
26.1K

CVE-2012-5003

UnknownEPSS 3.15%

Last modified

CVE-2012-5003 is a vulnerability of currently unknown severity. nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.. EPSS estimates a 3.15% chance of exploitation in the next 30 days.

Description

nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.

Metrics

EPSS Probability
3.15%

86.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
NomachineNx Web Companion<= 3.5.0-2—
NomachineNx Web Companion1.5.0Beta2
NomachineNx Web Companion2.0.0-1—
NomachineNx Web Companion2.1.0-1—
NomachineNx Web Companion3.0.0-1—
NomachineNx Web Companion3.0.0-2—
NomachineNx Web Companion3.0.0-3—
NomachineNx Web Companion3.0.0-4—
NomachineNx Web Companion3.0.0-5—
NomachineNx Web Companion3.1.0-1—
NomachineNx Web Companion3.2.0-1—
NomachineNx Web Companion3.3.0-1—
NomachineNx Web Companion3.3.0-2—
NomachineNx Web Companion3.4.0-1—
NomachineNx Web Companion3.4.0-2—
NomachineNx Web Companion3.4.0-3—
NomachineNx Web Companion3.5.0-1—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-5003?
nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.
How severe is CVE-2012-5003?
Severity scoring for CVE-2012-5003 is pending analysis. The EPSS model estimates a 3.15% probability of exploitation in the next 30 days.
How do I fix CVE-2012-5003?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-5003?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST