PT-2012-4586 · Web · Web

Published 2012-06-27 · Updated 2012-06-28 · CVE-2012-3231

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions web@all versions prior to the version downloaded on May 30, 2012

Description The issue allows remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information. This can be demonstrated by adding a file to execute arbitrary code via a "do addfile" action to "inc/browser/action.php".

Recommendations For versions prior to the one downloaded on May 30, 2012, update to a version downloaded on or after May 30, 2012, to resolve the issue. As a temporary workaround, consider restricting access to the "inc/browser/action.php" file to minimize the risk of exploitation. Avoid using the "do addfile" action in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-3231

Affected Products

Web

References · 3

• 🔥 https://htbridge.com/advisory/HTB23094 · Exploit
• 🔥 http://securityfocus.com/bid/54109 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3231 · Security Note