CVE-2012-3513

Name	CVE-2012-3513
Description	munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	684076

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
munin (PTS)	buster	2.0.49-1	fixed
	bullseye	2.0.67-3	fixed
	bookworm, sid	2.0.71-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
munin	source	squeeze	(not affected)
munin	source	(unstable)	2.0.6-1			684076

[squeeze] - munin <not-affected> (vulnerable code introduced in 2.x)
http://www.munin-monitoring.org/ticket/1238