PT-2012-5722 · Parallels · Parallels H-Sphere

Longrifle0X + 1 · Published 2012-09-19 · Updated 2017-08-29 · CVE-2012-5004

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels H-Sphere version 3.3 Patch 1

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of admins for specific requests, including adding group plans via "admin/group plans.html" and adding extra packages via "admin/extra packs/create extra pack.html".

Recommendations For Parallels H-Sphere version 3.3 Patch 1, as a temporary workaround, consider restricting access to the "admin/group plans.html" and "admin/extra packs/create extra pack.html" endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-5004

Affected Products

Parallels H-Sphere

References · 6

• 🔥 http://packetstormsecurity.org/files/view/108972/VL-392.txt · Exploit
• http://secunia.com/advisories/47556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5004 · Security Note
• http://osvdb.org/78505 · Note
• http://vulnerability-lab.com/get_content.php?id=392 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72628 · Note