PT-2012-3047 · Flyspray · Flyspray

Vaibhav Gupta · Published 2012-02-14 · Updated 2017-08-29 · CVE-2012-1058

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Flyspray version 0.9.9.6

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an "admin.newuser" action to "index.php".

Recommendations For Flyspray version 0.9.9.6, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized requests. As a temporary workaround, restrict access to the "admin.newuser" action in "index.php" to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-1058

Affected Products

Flyspray

References · 8

• 🔥 https://exploit-db.com/exploits/18468 · Exploit
• 🔥 http://exploit-db.com/exploits/18468 · Exploit
• 🔥 http://packetstormsecurity.org/files/109507/Flyspray-0.9.9.6-Cross-Site-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1058 · Security Note
• http://secunia.com/advisories/47881 · Vendor Advisory
• http://osvdb.org/78923 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73051 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1058 · Note