CVE-2012-1498 Cross-site request forgery in n/a
Remote attackers can hijack administrator sessions to add users or modify pages via CSRF in Webfolio CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-1498?
CVE-2012-1498 is a medium-severity vulnerability in n/a, published on 19 Mar 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name.
Weakness: CWE-352
Which versions are affected by CVE-2012-1498?
It affects 13 products.
Products include Nikola Posa Webfoliocms1.0.2, Nikola Posa Webfoliocms1.0.3, Nikola Posa Webfoliocms1.0.4, Nikola Posa Webfoliocms1.0.5, Nikola Posa Webfoliocms1.0.6, Nikola Posa Webfoliocms1.0.7 and 7 more.
How do I fix CVE-2012-1498?
No fix has been published for CVE-2012-1498 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-1498 being exploited?
There is no known exploitation of CVE-2012-1498 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-99pv-r3jj-x8v5.