CVE-2012-2423

The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote attackers to obtain potentially sensitive information about the installation path and product version via a series of requests involving the Msxml2.XMLHTTP object.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:intuit:quickbooks:2009:*:*:*:*:*:*:*
cpe:2.3:a:intuit:quickbooks:2010:*:*:*:*:*:*:*
cpe:2.3:a:intuit:quickbooks:2011:*:*:*:*:*:*:*
cpe:2.3:a:intuit:quickbooks:2012:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*

History

23 Jul 2021, 15:12

Type Values Removed Values Added
CPE cpe:2.3:a:microsoft:ie:*:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*

Information

Published : 2012-04-25 20:55

Updated : 2024-02-04 18:16


NVD link : CVE-2012-2423

Mitre link : CVE-2012-2423

CVE.ORG link : CVE-2012-2423


JSON object : View

Products Affected

microsoft

  • internet_explorer

intuit

  • quickbooks
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor