Lucene search

[email protected]CVE-2012-0829

HistoryFeb 14, 2012 - 12:55 a.m.

CVE-2012-0829

2012-02-1400:55:00

CWE-352

[email protected]

web.nvd.nist.gov

cve-2012-0829

csrf

cross-site request forgery

xss

mibew messenger

nvd

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.8%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.

Affected configurations

NVD

Node

mibewmibew_messengerRange≤1.6.4

mibewmibew_messengerMatch1.0.6

mibewmibew_messengerMatch1.0.7

mibewmibew_messengerMatch1.0.8

mibewmibew_messengerMatch1.0.9

mibewmibew_messengerMatch1.0.10

mibewmibew_messengerMatch1.4.0

mibewmibew_messengerMatch1.4.1

mibewmibew_messengerMatch1.4.2

mibewmibew_messengerMatch1.5.0

mibewmibew_messengerMatch1.5.1

mibewmibew_messengerMatch1.5.2

mibewmibew_messengerMatch1.6.0

mibewmibew_messengerMatch1.6.1

mibewmibew_messengerMatch1.6.2

mibewmibew_messengerMatch1.6.3

CPENameOperatorVersion
mibew:mibew_messengermibew mibew messengerle1.6.4
mibew:mibew_messengermibew mibew messengereq1.0.6
mibew:mibew_messengermibew mibew messengereq1.0.7
mibew:mibew_messengermibew mibew messengereq1.0.8
mibew:mibew_messengermibew mibew messengereq1.0.9
mibew:mibew_messengermibew mibew messengereq1.0.10
mibew:mibew_messengermibew mibew messengereq1.4.0
mibew:mibew_messengermibew mibew messengereq1.4.1
mibew:mibew_messengermibew mibew messengereq1.4.2
mibew:mibew_messengermibew mibew messengereq1.5.0

CPE	Name	Operator	Version
mibew:mibew_messenger	mibew mibew messenger	le	1.6.4
mibew:mibew_messenger	mibew mibew messenger	eq	1.0.6
mibew:mibew_messenger	mibew mibew messenger	eq	1.0.7
mibew:mibew_messenger	mibew mibew messenger	eq	1.0.8
mibew:mibew_messenger	mibew mibew messenger	eq	1.0.9
mibew:mibew_messenger	mibew mibew messenger	eq	1.0.10
mibew:mibew_messenger	mibew mibew messenger	eq	1.4.0
mibew:mibew_messenger	mibew mibew messenger	eq	1.4.1
mibew:mibew_messenger	mibew mibew messenger	eq	1.4.2
mibew:mibew_messenger	mibew mibew messenger	eq	1.5.0

Rows per page:

1-10 of 161

References

archives.neohapsis.com/archives/bugtraq/2012-01/0178.html

secunia.com/advisories/47787

www.codseq.it/advisories/mibew_messenger_multiple_xss

www.openwall.com/lists/oss-security/2012/02/02/10

www.securityfocus.com/bid/51723

exchange.xforce.ibmcloud.com/vulnerabilities/72822

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.8%

JSON

Related for CVE-2012-0829

prion1 cvelist1 nvd1