CVE-2012-10022
BaseFortify
Publication date: 2025-08-01
Last updated on: 2025-08-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lxlabs | kloxo | 6.1.6 |
| lxlabs | kloxo | 6.1.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Kloxo versions 6.1.12 and earlier have two setuid root binaries, lxsuexec and lxrestart, that allow local users with uid 48 (typically Apache user) to escalate their privileges to root. The lxsuexec binary checks if the user has uid 48 and then permits execution of arbitrary commands as root, enabling attackers with Apache-level access to gain root privileges without authentication.
How can this vulnerability impact me? :
This vulnerability allows an attacker who has Apache-level access (uid 48) to escalate their privileges to root on the affected system. This means an attacker can gain full control over the system, potentially leading to unauthorized access, data theft, system compromise, and disruption of services.