PT-2013-2016 · Elgg · Elgg

Published 2013-05-23 · Updated 2017-08-29 · CVE-2012-6562

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Elgg versions prior to 1.8.5

Description The issue is related to improper permission specification for the useradd action in the engine/lib/users.php file. This allows remote attackers to create arbitrary accounts.

Recommendations For versions prior to 1.8.5, update to version 1.8.5 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-6562

Affected Products

Elgg

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-6562 · Security Note
• http://secunia.com/advisories/49129 · Vendor Advisory
• http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip · Vendor Advisory
• http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75757 · Note
• http://securityfocus.com/bid/53623 · Note