CVE-2012-4051
Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1)…
Does this matter?
Lower severity and a low EPSS score (1.47%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- jamf/casper suite
- Source
- cve@mitre.org
References
- http://infosec42.blogspot.com/2012/09/jamf-casper-suite-mdm-csrf-vulnerability.htmlExploit
- http://jamfsoftware.com/libraries/pdf/products/documentation/Casper_Suite_8.61_Release_Notes.pdfVendor Advisory
- http://www.kb.cert.org/vuls/id/555668US Government Resource
- http://infosec42.blogspot.com/2012/09/jamf-casper-suite-mdm-csrf-vulnerability.htmlExploit
- http://jamfsoftware.com/libraries/pdf/products/documentation/Casper_Suite_8.61_Release_Notes.pdfVendor Advisory
- http://www.kb.cert.org/vuls/id/555668US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.