PT-2012-3973 · Renaud Bastide Christophe Wolfhugel · Sympa

Micah Anderson · Published 2012-05-31 · Updated 2012-08-14 · CVE-2012-2352

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sympa versions prior to 6.1.11

Description The issue concerns the archive management page in Sympa, where a lack of permission checks allows remote attackers to perform unauthorized actions on list archives. This can be achieved through vectors related to the do arc manage, do arc download, or do arc delete functions.

Recommendations For versions prior to 6.1.11, update to version 6.1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the archive management page to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2352

DSA-2477-1

Affected Products

Sympa

References · 19

• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2352 · Security Note
• http://secunia.com/advisories/49237 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2352 · Vendor Advisory
• http://debian.org/security/2012/dsa-2477 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2352 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2352 · Vendor Advisory
• http://secunia.com/advisories/49045 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-2352 · Security Note
• https://ubuntu.com/security/CVE-2012-2352 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/05/12/8 · Note
• http://osvdb.org/81890 · Note
• http://openwall.com/lists/oss-security/2012/05/11/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2352 · Note
• https://sympa.org/distribution/latest-stable/NEWS · Note