VulnerabilityModified
CVE-2012-3362
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
MEDIUM 6.8EPSS 0.89%
Does this matter?
Lower severity and a low EPSS score (0.89%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 0.89% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- extplorer/extplorer
- Source
- secalert@redhat.com
References
- http://www.autosectools.com/Advisories/eXtplorer.2.1.RC3_Cross-site.Request.Forgery_174.htmlExploit
- http://www.debian.org/security/2012/dsa-2510
- http://www.openwall.com/lists/oss-security/2012/06/24/1
- http://www.openwall.com/lists/oss-security/2012/06/25/1
- http://www.openwall.com/lists/oss-security/2012/06/26/1
- http://www.openwall.com/lists/oss-security/2012/06/27/1
- http://www.autosectools.com/Advisories/eXtplorer.2.1.RC3_Cross-site.Request.Forgery_174.htmlExploit
- http://www.debian.org/security/2012/dsa-2510
- http://www.openwall.com/lists/oss-security/2012/06/24/1
- http://www.openwall.com/lists/oss-security/2012/06/25/1
- http://www.openwall.com/lists/oss-security/2012/06/26/1
- http://www.openwall.com/lists/oss-security/2012/06/27/1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.