PT-2012-4741 · Ushahidi · Ushahidi Platform

Dennison Williams + 1 · Published 2012-08-12 · Updated 2012-08-13 · CVE-2012-3472

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5

Description The issue concerns the email API in the Ushahidi Platform, which does not require authentication. This allows remote attackers to list, delete, or organize messages via a GET request to the API endpoint.

Recommendations For versions prior to 2.5, consider requiring authentication for the email API to prevent unauthorized access. As a temporary workaround, restrict access to the email API endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-3472

Affected Products

Ushahidi Platform

References · 4

• 🔥 https://github.com/ushahidi/Ushahidi_Web/commit/4c24325 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3472 · Security Note
• http://openwall.com/lists/oss-security/2012/08/09/5 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3472 · Note