Information disclosure in Intuit Quickbooks
CVE-2012-2423
The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote attackers to obtain potentially sensitive information about the installation path and product version via a series of requests involving the Msxml2.XMLHTTP object.
Vulnerability class: Information Disclosure
EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.
Affected products
- Intuit Quickbooks — versions 2009, 2010, 2011
- Microsoft Internet_explorer
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, Exploit, x_refsource_BUGTRAQ)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)