CVE-2012-5891

Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/80745
http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html	Exploit
http://www.exploit-db.com/exploits/18685	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dalbum:dalbum::174::::::*
	cpe:2.3:a:dalbum:dalbum:1.03:::::::*
	cpe:2.3:a:dalbum:dalbum:1.3:::::::*
	cpe:2.3:a:dalbum:dalbum:1.04:::::::*
	cpe:2.3:a:dalbum:dalbum:1.05:::::::*
	cpe:2.3:a:dalbum:dalbum:1.06:::::::*
	cpe:2.3:a:dalbum:dalbum:1.07:::::::*
	cpe:2.3:a:dalbum:dalbum:1.08:::::::*
	cpe:2.3:a:dalbum:dalbum:1.09:::::::*
	cpe:2.3:a:dalbum:dalbum:1.10:::::::*
	cpe:2.3:a:dalbum:dalbum:1.20:::::::*
	cpe:2.3:a:dalbum:dalbum:1.21:::::::*
	cpe:2.3:a:dalbum:dalbum:1.22:::::::*
	cpe:2.3:a:dalbum:dalbum:1.22:sp2::::::
	cpe:2.3:a:dalbum:dalbum:1.22:sp3::::::
	cpe:2.3:a:dalbum:dalbum:1.22:sp4::::::
	cpe:2.3:a:dalbum:dalbum:1.22:sp5::::::
	cpe:2.3:a:dalbum:dalbum:1.22:sp6::::::
	cpe:2.3:a:dalbum:dalbum:1.22:sp7::::::
	cpe:2.3:a:dalbum:dalbum:1.31:::::::*
	cpe:2.3:a:dalbum:dalbum:1.32:::::::*
	cpe:2.3:a:dalbum:dalbum:1.33:::::::*
	cpe:2.3:a:dalbum:dalbum:1.34:::::::*
	cpe:2.3:a:dalbum:dalbum:1.35:::::::*

History

No history.

Information

Published : 2012-11-17 21:55

Updated : 2024-02-28 12:00

NVD link : CVE-2012-5891

Mitre link : CVE-2012-5891

CVE.ORG link : CVE-2012-5891

JSON object : View

Products Affected

dalbum

dalbum

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2012-5891", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-11-17T21:55:03.783", "references": [{"url": "http://osvdb.org/80745", "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/18685", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de peticiones en sitios cruzados (CSRF) en foto/pass.php en DAlbum 1.44 build 174 y versiones anteriores permiten a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores de las solicitudes que (1) a\u00f1aden un usuario a trav\u00e9s de una acci\u00f3n 'add', (2) cambian las contrase\u00f1as de los usuarios a trav\u00e9s de una acci\u00f3n de cambio ('change'), o (3) borran a un usuario a trav\u00e9s de una acci\u00f3n de eliminaci\u00f3n ('delete').\r\n"}], "lastModified": "2013-01-15T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dalbum:dalbum:*:174:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30AE0511-D402-4646-B3BF-8F93DA710D24", "versionEndIncluding": "1.44"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A923E3B3-0A72-47F6-AAED-16D98B38EE9C"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "848C3E7A-E337-4926-B504-CC1D6B68279C"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8500168-C824-4BAB-B5A8-B33FE5AE073B"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9A185A1-27DC-419B-8BB7-948E04195B49"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "294225D4-7BD0-4778-BF9A-035584872F18"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.07:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E9F676F-9B8E-4B4D-8F3E-9B359C07280B"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED720FF8-ED87-474D-BB2B-5691FAAFF235"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.09:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CBD3343-5B90-4B97-8C53-6EF4F7029E17"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BDDAA6E-9EC7-4368-A641-B47F6641015F"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA354007-794B-44A2-8CDC-9A4D20FDFC80"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CC00618-0F00-44D4-82DB-7DC752437660"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4EBE1CA-9578-4C9D-8399-27FB3000BF3C"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B68886CF-7DEB-49BF-ABE9-28EA01BA9311"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4822F938-1894-4648-B07E-A2D9516467B1"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38729055-3A22-4191-ACB8-A2219BF421CD"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0B3189A-30F6-46A6-86F9-F1F28E4BBA6F"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3950993C-8BF4-4F75-8F68-6DA4ECAFB6C4"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.22:sp7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD8B31F4-45E2-4D02-B4FC-75E34B400227"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C9575E2-B736-428A-A576-404D0DFE8AD6"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B721280A-C065-4212-B2CF-A886AB329B7D"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFA99B11-1D12-48ED-A109-F5DC6872996B"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DD159DF-FA54-42AF-8D31-5DCFDFE62DB2"}, {"criteria": "cpe:2.3:a:dalbum:dalbum:1.35:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47B7200C-85E4-48E4-B7F4-7241C3A977D4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}