CVE-2012-4678

CVE-2012-4678 is a medium-severity vulnerability in Munin-monitoring Munin with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-399.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 2% (81st percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-399
• Affected product: Munin-monitoring Munin
• Published: 2012-08-26
• Last modified: 2026-06-16

Description

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service (disk consumption) via many requests to an image with unique parameters.

Frequently asked questions

What is CVE-2012-4678?

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service (disk consumption) via many requests to an image with unique parameters.

How severe is CVE-2012-4678?

CVE-2012-4678 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2012-4678 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2012-4678?

CVE-2012-4678 affects Munin-monitoring Munin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2012-4678?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2012-4678 published?

CVE-2012-4678 was published on 2012-08-26 and last updated on 2026-06-16.

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668667
• http://munin-monitoring.org/changeset/4825
• http://www.openwall.com/lists/oss-security/2012/04/16/5
• http://www.openwall.com/lists/oss-security/2012/04/16/6
• http://www.openwall.com/lists/oss-security/2012/04/18/2
• http://www.openwall.com/lists/oss-security/2012/04/19/3
• http://www.openwall.com/lists/oss-security/2012/04/19/4
• http://www.openwall.com/lists/oss-security/2012/04/19/5
• http://www.openwall.com/lists/oss-security/2012/04/27/7
• http://www.openwall.com/lists/oss-security/2012/04/29/2
• http://www.securityfocus.com/bid/53034
• https://bugzilla.redhat.com/show_bug.cgi?id=812889

Affected products (1)

• cpe:2.3:a:munin-monitoring:munin:2.0_rc4:*:*:*:*:*:*:*

More vulnerabilities in Munin-monitoring Munin

• CVE-2012-3513 — Critical (CVSS 9.3): munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new…
• CVE-2012-3512 — High (CVSS 7.2): Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins,…
• CVE-2012-2104 — Medium (CVSS 6.8): cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might…
• CVE-2017-6188 — Medium (CVSS 5.5): Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET…
• CVE-2013-6048 — Medium (CVSS 5.0): The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a…
• CVE-2012-2147 — Medium (CVSS 5.0): munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service (disk or memory consumption) via…

All CVEs affecting Munin-monitoring Munin →

Other CWE-399 (Resource Management Errors) vulnerabilities

• CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
• CVE-2015-0339 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2015-0335 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2015-0333 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2014-4121 — Critical (CVSS 10.0): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized…
• CVE-2014-0560 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS…

Browse all CWE-399 (Resource Management Errors) vulnerabilities →