CVE-2012-6562 Missing authorization in n/a

What is CVE-2012-6562?

CVE-2012-6562 is a medium-severity missing authorization vulnerability in n/a, published on 23 May 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.

Weakness: CWE-264

Which versions are affected by CVE-2012-6562?

It affects 1 product.

Products include Elgg Elgg.

How do I fix CVE-2012-6562?

No fix has been published for CVE-2012-6562 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-6562 being exploited?

There is no known exploitation of CVE-2012-6562 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2011-2936 SQL injection in Elgg Critical 9.8
• CVE-2021-4072 Cross-site Scripting (XSS) - Stored in elgg/elgg Critical 9.0
• CVE-2011-2935 Elgg Reflected XSS Vulnerability Medium 6.1
• CVE-2019-11016 Elgg open redirect Medium 6.1
• CVE-2021-3980 Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wx93-8gv6-wmq3.