PT-2012-3973 · Renaud Bastide Christophe Wolfhugel · Sympa

Micah Anderson · Publicado 2012-05-31 · Atualizado 2012-08-14 · CVE-2012-2352

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sympa versions prior to 6.1.11

Description The issue concerns the archive management page in Sympa, where a lack of permission checks allows remote attackers to perform unauthorized actions on list archives. This can be achieved through vectors related to the do arc manage, do arc download, or do arc delete functions.

Recommendations For versions prior to 6.1.11, update to version 6.1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the archive management page to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-2352

DSA-2477-1

Produtos afetados

Sympa

Referências · 19

• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2352 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/05/12/8 · Nota
• http://osvdb.org/81890 · Nota
• http://openwall.com/lists/oss-security/2012/05/11/8 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2352 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2352 · Nota de Segurança
• http://secunia.com/advisories/49237 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-2352 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2477 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2352 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-2352 · Aviso do Fabricante
• http://secunia.com/advisories/49045 · Aviso do Fabricante
• https://sympa.org/distribution/latest-stable/NEWS · Nota
• https://cve.org/CVERecord?id=CVE-2012-2352 · Nota de Segurança
• https://ubuntu.com/security/CVE-2012-2352 · Aviso do Fabricante